CVE-2026-72825: Missing Authorization

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...

CVE-2026-72822: Missing Authentication for Critical Function

The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...

CVE-2026-65896: External Control of File Name or Path

Grav API Plugin Composer package getgrav/grav-plugin-api before 1.0.10 fails to properly validate the slug field in the POST /pages/route/move endpoint. PagesController::move sanitizes the slug only with ltrim$body'slug', '.', which strips leading periods but does not neutralize '/' or '..'...