CVE-2026-72824 Grav before 1.0.13 API Key Scope Bypass via PagesController
Least-privilege API keys can bypass scope restrictions to enable Twig processing, leading to server-side template injection and remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72824?
CVE-2026-72824 is a high-severity missing authorization vulnerability in getgrav grav, published on 14 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check uses a bare isSuperAdmin() gate that does not consult api_key_scopes, so a least-privilege API key scoped only to api.pages.write and minted on a super account can enable process.twig on a page save even though admin.pages_twig is intentionally outside the api.pages scope. When security.twig_content.process_enabled=true and editor_enabled=false, this allows Twig-in-content to execute server-side, resulting in server-side template injection (SSTI) and remote code execution.
Weakness: CWE-862
Which versions are affected by CVE-2026-72824?
How do I fix CVE-2026-72824?
No fix has been published for CVE-2026-72824 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-72824 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72824 exists.
Sources
Also known as GHSA-qpvv-mv8x-vg3c.