CVE-2026-72824: Grav API Plugin Twig Toggle Bypass Escalates Least-Privilege Keys

Overview

A second critical vulnerability in the Grav API plugin (getgrav/grav-plugin-api) has been disclosed alongside CVE-2026-72822, this time targeting the page-management layer. CVE-2026-72824 (CVSS 9.8 — Critical) allows an API key scoped only to api.pages.write to enable Twig template processing on arbitrary pages — a capability that should require super-admin privileges. Combined with Twig's ability to execute PHP-like expressions, this flaw can be a stepping stone to remote code execution on misconfigured Grav installations.

Vulnerability Details

The Grav API plugin's PagesController exposes a guardTwigContent() method to gate whether an API caller may toggle the Twig-processing flag on a page's frontmatter. The bug:

• guardTwigContent() checks only isSuperAdmin() to decide whether to allow the Twig toggle.
• It does not consult api_key_scopes — the mechanism that restricts what a given API key is permitted to do.
• An API key minted with only api.pages.write scope (a least-privilege configuration) can therefore send a page update request that flips the Twig-enable flag, bypassing the intended super-admin restriction entirely.

Why Twig Matters

When Twig processing is enabled on a Grav page, the CMS evaluates Twig expressions embedded in page content. Depending on the Grav configuration and installed plugins, this can allow an attacker to:

• Read arbitrary server-side environment variables and configuration values.
• Invoke PHP functions through Twig extensions.
• On permissive setups, achieve remote code execution via {{ system('id') }} or similar constructs.

Relationship to CVE-2026-72822

CVE-2026-72822 and CVE-2026-72824 share the same root cause: the Grav API plugin does not apply api_key_scopes enforcement consistently across all sensitive endpoints. Both were patched together in grav-plugin-api 1.0.13.

Impact

Affected Versions

• getgrav/grav-plugin-api ≤ 1.0.12

Patch

grav-plugin-api 1.0.13 resolves this by adding api_key_scopes verification to guardTwigContent(), ensuring that the Twig toggle is only accessible to API keys explicitly granted super-admin scope — not just any key with page-write access.

Remediation

1. Upgrade immediately to grav-plugin-api >= 1.0.13:

   composer update getgrav/grav-plugin-api

   Copy

2. Audit page frontmatter: Check whether any pages have had process.twig: true set unexpectedly:

   grep -r "twig: true" user/pages/

   Copy

   Disable Twig on any pages where it was not intentionally enabled.

3. Review API keys: Revoke all existing API keys and reissue with the minimum required scopes. Do not issue api.pages.write keys to untrusted consumers until the patch is applied.

4. Harden Twig (defence-in-depth): If Twig is legitimately needed, restrict which PHP functions are accessible via the Grav configuration:

   # user/config/system.yaml
   twig:
     autoescape: true

   Copy

5. Disable the API plugin if not actively needed:

   bin/gpm disable api

   Copy

Notes on Combined Exposure

If your environment is affected by both CVE-2026-72822 and CVE-2026-72824, an attacker with any valid API key could:

1. Enable Twig on a page via the scope bypass (CVE-2026-72824).
2. Upload Twig payload content to that page.
3. Disable 2FA on an administrator account (CVE-2026-72822) to gain persistent access.

Upgrading to 1.0.13 closes both vectors simultaneously.

References

• NVD — CVE-2026-72824
• NVD — CVE-2026-72822
• Grav API Plugin — GitHub
• Grav Twig Documentation