CyberRota Analysis
AI-GeneratedThe getgrav/grav-plugin-api plugin prior to version 1.0.13 is vulnerable due to a bypass in the API-key scope enforcement, allowing attackers with a least-privilege API key to manipulate the security.twig_sandbox allowlist. This misconfiguration can lead to Server-Side Template Injection (SSTI) and Remote Code Execution (RCE) vulnerabilities, posing a significant risk to the integrity and security of affected systems. Organizations using this plugin, especially those with elevated privileges, should prioritize updating to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of requireSuper(). Because isSuperAdmin() reads access.api.super directly and never consults api_key_scopes, a least-privilege API key scoped to api.config.write minted on a super account passes the gate, allowing an attacker to append attacker-chosen tokens to the security.twig_sandbox allowlist (persisted to user/config/security.yaml). Widening the allowlist turns any subsequent Twig-in-content render into an SSTI/RCE sink.