API key scope-cap bypass enabling SSTI in Grav API plugin (CVE-2026-72824)

The Grav API plugin's `PagesController::guardTwigContent()` enforces the Twig-toggle check with a bare `isSuperAdmin()` gate that never consults `api_key_scopes`. A least-privilege API key scoped only to `api.pages.write` but minted on a super account bypasses the scope cap and can enable `process.twig` on page save, since `admin.pages_twig` is intentionally outside the `api.pages` scope hierarchy. When `security.twig_content.process_enabled=true` and `editor_enabled=false`, this results in server-side template injection (SSTI) and remote code execution (RCE). Affected versions: - <= 1.0.12 We recommend updating to: 1.0.13. CVSS 9.3 · our assessment: act_now Reference: https://github.com/getgrav/grav/security/advisories/GHSA-96xv-p87j-58mx Details: https://vuln.today/cve/CVE-2026-72824