CVE-2026-72822 getgrav CVE debrief

Who should care

Administrators and users of the getgrav/grav-plugin-api package, especially those with API keys or administrative access, should be aware of this vulnerability and take immediate action to protect their systems.

Technical summary

The getgrav/grav-plugin-api Composer package before 1.0.13 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermission(), so the api_key_scopes cap is never applied. A holder of a narrow-scope API key on a super account, or a non-super account whose ACL includes api.users.write, can force-disable two-factor authentication on any non-super target account via POST /api/v1/users/{user}/2fa/disable without providing a TOTP code, facilitating account takeover.

Defensive priority

CVE-2026-72822 is rated HIGH with a CVSS score of 8.7; verify and apply vendor patches immediately.

Recommended defensive actions

• Verify and apply the vendor patch to update the getgrav/grav-plugin-api Composer package to version 1.0.13 or later.
• Review and restrict API key scopes to prevent unauthorized access.
• Implement additional monitoring to detect potential exploitation attempts.
• Conduct an inventory check to identify affected systems and prioritize remediation.
• Consider compensating controls, such as IP restrictions or rate limiting, until patching is complete.

Evidence notes

The getgrav/grav-plugin-api Composer package before 1.0.13 fails to enforce API key scope caps on the disable2fa endpoint. A holder of a narrow-scope API key on a super account, or a non-super account whose ACL includes api.users.write, can force-disable two-factor authentication on any non-super target account via POST /api/v1/users/{user}/2fa/disable without providing a TOTP code, facilitating account takeover. Evidence is based on CVE and NVD records; further verification is recommended.

Official resources