CVE-2026-72825 getgrav CVE debrief

Who should care

Administrators and users of the getgrav/grav-plugin-api plugin should assess their exposure and take necessary actions to prevent potential exploitation. This includes reviewing and updating the plugin to version 1.0.13 or later, restricting access to the vulnerable endpoint, and monitoring for suspicious activity.

Why it matters

The CVE-2026-72825 vulnerability in getgrav/grav-plugin-api plugin requires immediate attention from administrators and users. The API-key scope cap bypass allows an attacker to manipulate the security.twig_sandbox allowlist, potentially leading to SSTI/RCE. Defenders should verify their exposure, update to version 1.0.13 or later, restrict access to the vulnerable endpoint, and monitor for suspicious activity.

• Potential SSTI/RCE vulnerability
• Elevation of privileges through API-key scope cap bypass
• Security configuration tampering
• Possible code execution via twig content rendering

Technical summary

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint. The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of requireSuper(). Because isSuperAdmin() reads access.api.super directly and never consults api_key_scopes, a least-privilege API key scoped to api.config.write minted on a super account passes the gate, allowing an attacker to append attacker-chosen tokens to the security.twig_sandbox allowlist (persisted to user/config/security.yaml).

Defensive priority

High

Recommended defensive actions

• Review and update the getgrav/grav-plugin-api plugin to version 1.0.13 or later
• Restrict access to the POST /reports/twig-content/allowlist endpoint
• Monitor for suspicious activity related to the security.twig_sandbox allowlist
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected versions and potential impact require verification from official sources. The getgrav/grav-plugin-api plugin before 1.0.13 is affected, and defenders should verify their exposure and update to version 1.0.13 or later. The CVE Program record and NVD detail page offer additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.