CVE-2026-72825

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of requireSuper(). Because isSuperAdmin() reads access.api.super directly and never consults api_key_scopes, a least-privilege API key scoped to api.config.write minted on a super account passes the gate, allowing an attacker to append attacker-chosen tokens to the security.twig_sandbox allowlist (persisted to user/config/security.yaml). Widening the allowlist turns any subsequent Twig-in-content render into an SSTI/RCE sink.

• CWE-862

• https://github.com/getgrav/grav/security/advisories/GHSA-v5ph-7v92-wqm6
• https://www.vulncheck.com/advisories/grav-before-api-key-scope-cap-bypass-via-reportscontroller
• https://github.com/getgrav/grav/security/advisories/GHSA-v5ph-7v92-wqm6

Published

Aug 14, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7282A vulnerability was identified in SourceCodester Pharmacy Sa…4.7
• CVE-2026-72820Grav versions before 2.0.13 fail to properly validate backup…4.9
• CVE-2026-72821Grav Form plugin versions before 9.1.15 contain a stored cro…5.4
• CVE-2026-72822The getgrav/grav-plugin-api Composer package before 1.0.13 (…8.8
• CVE-2026-72823The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 …5.4
• CVE-2026-72824The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 …8.8
• CVE-2026-72826The getgrav/grav-plugin-api plugin before 1.0.13 fails to va…8.8
• CVE-2026-72827Grav CMS before 2.0.13 contains a server-side template injec…8.8
• CVE-2026-72828Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fail…7.2
• CVE-2026-72829The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 …8.8
• CVE-2026-7283A security flaw has been discovered in SourceCodester Pharma…4.7
• CVE-2026-72830Grav API plugin versions before 1.0.13 fail to enforce API k…8.8