A missing authorization check in the getgrav/grav-plugin-api Composer package allows API key holders to force-disable two-factor authentication on non-super accounts without supplying a TOTP code, opening the door to account takeover.
What Is It
The vulnerability is a missing authentication/authorization enforcement flaw (CWE-306) in the disable2fa endpoint of the getgrav/grav-plugin-api package. Unlike its sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely through ACL reads, isSuperAdmin() and hasPermission(), and never calls requirePermission(). Because requirePermission() is where the API key scope cap is applied, the api_key_scopes restriction is never enforced on this path.
The result: a holder of a narrow-scope API key on a super account, or a non-super account whose ACL includes api.users.write, can send POST /api/v1/users/{user}/2fa/disable and strip 2FA from any non-super target account without providing a TOTP code.
Why It Matters
VulnCheck rates this CRITICAL, CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with a CVSS 4.0 score of 9.3. The attack is network-reachable, low-complexity, and requires no user interaction, with high impact to confidentiality, integrity, and availability.
One caveat on that vector: the published PR:N metric does not match the vulnerability as described. Every documented path to disable2fa starts from an authenticated position; the attacker must already hold a valid API key, either scoped down on a super account or attached to a non-super account carrying api.users.write. That is low privilege, not none, and a vector reflecting the described attack would carry PR:L and a correspondingly lower base score. The flaw is that the scope cap on an already-issued key is not enforced, so treat this as a privilege-escalation and containment failure rather than an unauthenticated remote takeover.
Practically, this defeats the second factor that was supposed to be the backstop against credential compromise. An API key intentionally scoped down to limited privileges becomes a tool for stripping 2FA off other accounts; a direct path to account takeover.
CVE-2026-72822 does not appear in the CISA Known Exploited Vulnerabilities catalog as of 2026-08-14, so active exploitation is not currently confirmed.
What's Vulnerable
- Vendor/Product: getgrav; Grav (
grav-plugin-apiComposer package) - Affected versions: all versions before 1.0.13 (affected
<= 1.0.12) - Unaffected: 1.0.13 and later
Patch Status
Upgrade getgrav/grav-plugin-api to 1.0.13, which is listed as unaffected. The record was published 2026-08-14 and is still in Received status at NVD, so enrichment (including CPE data) may change. Operators who cannot patch immediately should treat any API key with api.users.write, or any key on a super account; as effectively unscoped for 2FA disablement.
Sources
- NVD, CVE-2026-72822: https://nvd.nist.gov/vuln/detail/CVE-2026-72822
- GitHub Security Advisory GHSA-22p9-6fh4-mmf2: https://github.com/getgrav/grav/security/advisories/GHSA-22p9-6fh4-mmf2
- VulnCheck Advisory; Grav authentication bypass via disable2fa: https://www.vulncheck.com/advisories/grav-before-authentication-bypass-via-disable2fa
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog