Description

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check uses a bare isSuperAdmin() gate that does not consult api_key_scopes, so a least-privilege API key scoped only to api.pages.write and minted on a super account can enable process.twig on a page save even though admin.pages_twig is intentionally outside the api.pages scope. When security.twig_content.process_enabled=true and editor_enabled=false, this allows Twig-in-content to execute server-side, resulting in server-side template injection (SSTI) and remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-14T12:16:45.520Z",
  "pubdate": "2026-08-14T12:16:45.520Z",
  "executiveSummary": "An API key scope-cap bypass vulnerability exists in the Grav API plugin (getgrav/grav-plugin-api) prior to version 1.0.13. The vulnerability is characterized by a deficient authorization check within the Twig-toggle mechanism, specifically residing in PagesController::guardTwigContent(). This flaw enables a least-privilege API key, restricted to the api.pages.write scope and originally minted on a superuser account, to bypass intended privilege limitations and activate process.twig during page save operations, even though admin.pages_twig resides outside the authorized api.pages scope.\nThe impact of this vulnerability includes Server-Side Template Injection (SSTI) and subsequent Remote Code Execution (RCE) on the underlying server. Exploitation requires the global configuration settings security.twig_content.process_enabled to be set to true and editor_enabled to be set to false. An attacker possessing a constrained API key can leverage this logic flaw to execute arbitrary server-side code, compromising the entire application environment.",
  "technicalDetails": "The root cause of the vulnerability stems from the PagesController::guardTwigContent() method within the getgrav/grav-plugin-api plugin prior to version 1.0.13. During the evaluation of Twig-toggle permissions on page save requests, the validation logic relies exclusively on a bare isSuperAdmin() gate. The implementation fails to consult or validate the assigned api_key_scopes associated with the incoming authentication token.\nConsequently, if an API key is generated from a superuser account but explicitly scoped down to least-privilege operations such as api.pages.write, the missing scope verification allows the request to bypass the restriction. The administrative boundary intended to keep admin.pages_twig outside the api.pages scope is circumvented, permitting the activation of process.twig during content persistence.\nThe attack flow proceeds as follows: 1. The attacker acquires or utilizes a least-privilege API key possessing the api.pages.write scope, minted from a superuser account. 2. The attacker crafts a malicious page save request containing Twig template directives. 3. The request is submitted to the Grav API endpoint. 4. The vulnerable PagesController::guardTwigContent() function processes the request, evaluating the user context via the unconstrained isSuperAdmin() check rather than validating api_key_scopes. 5. The check passes erroneously, allowing process.twig to be enabled for the page content. 6. Provided that security.twig_content.process_enabled is set to true and editor_enabled is set to false, the server interprets and executes the embedded Twig directives, resulting in Server-Side Template Injection (SSTI) and Remote Code Execution (RCE)."
}