Description

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of requireSuper(). Because isSuperAdmin() reads access.api.super directly and never consults api_key_scopes, a least-privilege API key scoped to api.config.write minted on a super account passes the gate, allowing an attacker to append attacker-chosen tokens to the security.twig_sandbox allowlist (persisted to user/config/security.yaml). Widening the allowlist turns any subsequent Twig-in-content render into an SSTI/RCE sink.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-14T12:16:45.650Z",
  "pubdate": "2026-08-14T12:16:45.650Z",
  "executiveSummary": "An API-key scope cap bypass vulnerability exists in the getgrav/grav-plugin-api plugin prior to version 1.0.13.\nThe vulnerability affects the POST /reports/twig-content/allowlist endpoint handled by the ReportsController.\nThe flaw allows a least-privilege API key, which is scoped specifically to api.config.write and minted on a super account, to bypass intended scope restrictions and successfully pass access controls.\nSuccessful exploitation enables an attacker to append arbitrary tokens to the security.twig_sandbox allowlist, which is persistently stored in user/config/security.yaml.\nBy widening the Twig sandbox allowlist, subsequent Twig-in-content rendering operations are transformed into Server-Side Template Injection (SSTI) and Remote Code Execution (RCE) sinks.\nThe attack requires authentication via an API key possessing the api.config.write scope.\nThe risk implication is critical, as it directly escalates limited API key privileges to persistent configuration tampering and potential remote code execution on the underlying server.",
  "technicalDetails": "The root cause of the vulnerability resides in flawed authorization logic within the POST /reports/twig-content/allowlist endpoint managed by the ReportsController in the getgrav/grav-plugin-api plugin before version 1.0.13.\nThe endpoint initially enforces a requirePermission('api.config.write') check, which is subsequently followed by a bare isSuperAdmin() check instead of the correct requireSuper() function.\nThe underlying implementation of isSuperAdmin() evaluates access.api.super directly and fails to consult the api_key_scopes validation mechanism.\nConsequently, an API key minted on a super account but restricted via least-privilege principles to the api.config.write scope successfully bypasses the intended security gate.\nThe attack flow proceeds as follows: an attacker obtains or utilizes a least-privilege API key scoped to api.config.write that was generated on a super account. The attacker sends a malicious HTTP POST request to the /reports/twig-content/allowlist endpoint.\nDue to the improper authorization checks, the application accepts the request and permits the attacker to supply attacker-chosen tokens.\nThese supplied tokens are appended directly to the security.twig_sandbox allowlist and are subsequently persisted to the configuration file located at user/config/security.yaml.\nPost-exploitation impact is severe because widening the security.twig_sandbox allowlist breaks the security boundaries of the Twig template engine.\nAny subsequent rendering of Twig-in-content within the application acts as a Server-Side Template Injection (SSTI) and Remote Code Execution (RCE) sink, allowing the execution of arbitrary system commands or code within the context of the web application user."
}