The vulnerability is an authorization bypass in Grav's Grav Plugin API before version 1.0.13. The POST /reports/twig-content/allowlist endpoint incorrectly checks permissions, allowing a key with api.config.write scope created on a super account to pass the check. An attacker can then append arbitrary tokens to the security.twig_sandbox allowlist stored in user/config/security.yaml, turning any later Twig-in-content rendering into a server‑side template injection and remote code execution sink. This flaw represents a high‑severity authorization bypass (CWE‑862) that could compromise confidentiality, integrity, or availability of the affected site.

The affected product is getgrav's Grav framework, version 1.0.13 or earlier (plugin grav-plugin-api before 1.0.13). The vulnerability resides in the Grav ReportsController, which is part of the Grav core. Users running any Grav instance that has not yet applied the 1.0.13 patch are potentially affected. The scope includes all API keys created from super accounts, regardless of their reduced api.config.write scope.

The CVSS score of 7.2 categorizes this flaw as high severity, indicating significant potential impact. Although the EPSS score is not available, the lack of public exploitation in the KEV does not diminish the urgency of remediation, as the flaw relies only on possession of a legitimate API key. Attackers who can obtain or compromise a least‑privilege api.config.write key from a super user can exploit the bypass remotely via an HTTP POST request to the vulnerable endpoint, leading to RCE if Twig templates are rendered subsequently. Consequently, administrators should treat this as a critical threat and apply the vendor patch or alternative controls immediately.