{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/grav-plugin-api--1.0.13/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-72824"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["grav-plugin-api (\u003c 1.0.13)","grav-plugin-api (\u003c 1.0.15)","grav-plugin-api"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","rce","ssti","grav-cms","web-application-vulnerability","cve-2026-75829"],"_cs_type":"advisory","_cs_vendors":["getgrav"],"content_html":"\u003cp\u003eThe Grav API plugin (getgrav/grav-plugin-api) version 1.0.13 and earlier contains a critical authorization vulnerability within the PagesController::guardTwigContent() method. The vulnerability stems from the plugin's failure to validate API key scopes when performing Twig-toggle checks. Specifically, the system utilizes a bare isSuperAdmin() gate instead of consulting the associated api_key_scopes.\u003c/p\u003e\n\u003cp\u003eThis flaw allows an attacker possessing an API key restricted to api.pages.write - provided it was minted on a super account - to override authorization controls and enable process.twig during page save operations. If the target Grav instance has security.twig_content.process_enabled set to true and editor_enabled set to false, an attacker can leverage this bypass to inject arbitrary Twig tags. This leads to Server-Side Template Injection (SSTI), granting the attacker the ability to execute code on the underlying host server. This vulnerability is significant for organizations relying on Grav API for content management as it effectively turns a restricted write operation into full system compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in unauthenticated or low-privilege Remote Code Execution (RCE) on the server hosting Grav CMS. If successfully exploited, an attacker gains the ability to execute arbitrary commands, read sensitive server files, and potentially move laterally within the network. This affects all installations of the Grav API plugin version 1.0.12 and below where the specified Twig processing configurations are active.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Grav API plugin to version 1.0.13 or higher immediately to apply the patch for CVE-2026-72824.\u003c/li\u003e\n\u003cli\u003eAudit all active API keys in the Grav environment to verify scopes and reduce the number of keys minted on super-administrator accounts.\u003c/li\u003e\n\u003cli\u003eReview the configuration file for security.twig_content.process_enabled and ensure it is set to false unless Twig-in-content functionality is strictly required for the business operation.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for HTTP requests directed at the PagesController or save-page endpoints containing unexpected Twig syntax (e.g., {{ ... }} or {% ... %}) in content fields.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T12:53:30Z","date_published":"2026-08-14T14:11:25Z","id":"https://feed.craftedsignal.io/briefs/2026-08-grav-api-bypass/","summary":"An API key scope-cap bypass in the Grav API plugin allows attackers with restricted keys to execute server-side templates via Server-Side Template Injection.","title":"Authentication Scope Bypass in Grav API Plugin Leading to RCE","url":"https://feed.craftedsignal.io/briefs/2026-08-grav-api-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Grav-Plugin-Api (\u003c 1.0.13)","version":"https://jsonfeed.org/version/1.1"}