PT-2026-71993

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult api key scopes, so a least-privilege API key scoped only to api.pages.write and minted on ...