CVE-2026-72822
Received Received - Intake

Two-Factor Authentication Bypass in Grav Plugin API

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermission(), so the api_key_scopes cap is never applied. As a result, a holder of a narrow-scope API key on a super account, or a non-super account whose ACL includes api.users.write, can force-disable two-factor authentication on any non-super target account via POST /api/v1/users/{user}/2fa/disable without providing a TOTP code, facilitating account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72822
EUVD
EUVD-2026-58636

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-api to 1.0.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Grav CMS plugin-api versions 1.0.12 and earlier. It allows attackers to bypass two-factor authentication (2FA) by exploiting the disable2fa endpoint. The endpoint only checks admin permissions via ACL reads and does not enforce API key scope restrictions, enabling unauthorized users to disable 2FA for any non-super account without providing a TOTP code.

Detection Guidance

Check Grav CMS plugin-api version with: composer show getgrav/grav-plugin-api. If version is <= 1.0.12, the system is vulnerable. Inspect API logs for POST requests to /api/v1/users/{user}/2fa/disable without TOTP verification.

Impact Analysis

This vulnerability can lead to account takeover. Attackers with a narrow-scope API key or sufficient ACL permissions can force-disable 2FA on any non-super account, gaining unauthorized access to sensitive data or system functions. The impact includes potential data breaches, unauthorized modifications, and loss of control over user accounts.

Mitigation Strategies

Upgrade getgrav/grav-plugin-api to version 1.0.13 or later immediately. Review API key scopes and ACL permissions for all accounts. Disable 2FA disable endpoints if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72822. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart