CVE-2026-72822

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.13

Description The software fails to enforce API key scope caps on the disable2fa endpoint. While the generate2fa endpoint correctly applies these caps, disable2fa authorizes the admin path using only ACL reads (isSuperAdmin/hasPermission) and does not invoke the requirePermission() function. Consequently, an attacker with a narrow-scope API key on a super account, or a non-super account with api.users.write ACL permissions, can disable two-factor authentication for any non-super target account via the POST '/api/v1/users/{user}/2fa/disable' endpoint without a TOTP (Time-based One-Time Password) code, which may lead to account takeover.

Recommendations Update getgrav/grav-plugin-api to version 1.0.13 or later. As a temporary mitigation, restrict access to the POST '/api/v1/users/{user}/2fa/disable' endpoint.