Overview
A critical authentication bypass vulnerability has been disclosed in the Grav API plugin (getgrav/grav-plugin-api), affecting all versions up to and including 1.0.12. Tracked as CVE-2026-72822 with a CVSS score of 9.8 (Critical), the flaw allows an attacker holding a least-privilege API key to disable two-factor authentication on any admin account — effectively enabling full account takeover without requiring the target user's credentials.
Vulnerability Details
The Grav API plugin exposes a disable2fa endpoint intended to let super-admins manage 2FA settings on behalf of other users. The bug lies in how authorization is applied to this endpoint versus its sibling generate2fa:
generate2facorrectly validates the requesting API key's configured scope caps before allowing privileged admin operations.disable2faonly checks ACL viaisSuperAdmin()andhasPermission()reads, but never invokes the API key scope cap enforcement logic.
As a result, any API key that can authenticate to the Grav API — regardless of how narrowly its scopes are configured — can send a request to disable2fa and strip 2FA protections from any administrator account. Once 2FA is removed, the attacker can authenticate as that admin using only a password (or by resetting it if the API key also exposes account-management routes).
Impact
| Attribute | Value |
|---|---|
| CVSS Score | 9.8 (Critical) |
| Attack Vector | Network |
| Privileges Required | Low (valid API key) |
| User Interaction | None |
| Impact | Account takeover / Full admin access |
Affected Versions
getgrav/grav-plugin-api≤ 1.0.12 (all versions prior to the patch)
Patch
The issue is resolved in grav-plugin-api 1.0.13. The fix adds scope cap validation to the disable2fa code path, bringing it into line with the enforcement already present in generate2fa.
Remediation
- Update immediately: Upgrade
getgrav/grav-plugin-apito 1.0.13 or later via Composer:composer update getgrav/grav-plugin-api - Audit API keys: Review all issued API keys and their assigned scopes. Revoke any keys that should not have had access to authentication management endpoints.
- Check 2FA status: Verify that administrator accounts have not had 2FA unexpectedly disabled. Re-enable 2FA for any affected accounts.
- Rotate credentials: If unauthorized 2FA removal is detected, treat all associated credentials as compromised and rotate them.
Recommendations
Sites running the Grav API plugin on public-facing infrastructure are at significant risk. The low privilege requirement (any valid API key) combined with no user interaction make this an attractive target for automated exploitation.
If you cannot upgrade immediately, consider disabling the API plugin entirely until the patch can be applied:
# Disable via Grav CLI
bin/gpm disable api