SECURITYCRITICALCVE-2026-72822

CVE-2026-72822: Grav API Plugin 2FA Scope Bypass Allows Admin Account Takeover

Grav API plugin before 1.0.13 fails to enforce API key scope caps on the disable2fa endpoint, enabling privilege escalation.

Dylan H.

Security Team

August 15, 2026
3 min read
CVE-2026-72822: Grav API Plugin 2FA Scope Bypass Allows Admin Account Takeover

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • getgrav/grav-plugin-api <= 1.0.12

Overview

A critical authentication bypass vulnerability has been disclosed in the Grav API plugin (getgrav/grav-plugin-api), affecting all versions up to and including 1.0.12. Tracked as CVE-2026-72822 with a CVSS score of 9.8 (Critical), the flaw allows an attacker holding a least-privilege API key to disable two-factor authentication on any admin account — effectively enabling full account takeover without requiring the target user's credentials.

Vulnerability Details

The Grav API plugin exposes a disable2fa endpoint intended to let super-admins manage 2FA settings on behalf of other users. The bug lies in how authorization is applied to this endpoint versus its sibling generate2fa:

  • generate2fa correctly validates the requesting API key's configured scope caps before allowing privileged admin operations.
  • disable2fa only checks ACL via isSuperAdmin() and hasPermission() reads, but never invokes the API key scope cap enforcement logic.

As a result, any API key that can authenticate to the Grav API — regardless of how narrowly its scopes are configured — can send a request to disable2fa and strip 2FA protections from any administrator account. Once 2FA is removed, the attacker can authenticate as that admin using only a password (or by resetting it if the API key also exposes account-management routes).

Impact

AttributeValue
CVSS Score9.8 (Critical)
Attack VectorNetwork
Privileges RequiredLow (valid API key)
User InteractionNone
ImpactAccount takeover / Full admin access

Affected Versions

  • getgrav/grav-plugin-api ≤ 1.0.12 (all versions prior to the patch)

Patch

The issue is resolved in grav-plugin-api 1.0.13. The fix adds scope cap validation to the disable2fa code path, bringing it into line with the enforcement already present in generate2fa.

Remediation

  1. Update immediately: Upgrade getgrav/grav-plugin-api to 1.0.13 or later via Composer: 
    composer update getgrav/grav-plugin-api
  2. Audit API keys: Review all issued API keys and their assigned scopes. Revoke any keys that should not have had access to authentication management endpoints.
  3. Check 2FA status: Verify that administrator accounts have not had 2FA unexpectedly disabled. Re-enable 2FA for any affected accounts.
  4. Rotate credentials: If unauthorized 2FA removal is detected, treat all associated credentials as compromised and rotate them.

Recommendations

Sites running the Grav API plugin on public-facing infrastructure are at significant risk. The low privilege requirement (any valid API key) combined with no user interaction make this an attractive target for automated exploitation.

If you cannot upgrade immediately, consider disabling the API plugin entirely until the patch can be applied:

# Disable via Grav CLI
bin/gpm disable api

References