CVE-2026-72822 getgrav CVE debrief

Who should care

Administrators and users of the getgrav/grav-plugin-api package, especially those with API keys or administrative access, should be aware of this vulnerability and take immediate action to protect their systems.

Technical summary

The getgrav/grav-plugin-api Composer package before 1.0.13 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermission(), so the api_key_scopes cap is never applied. A holder of a narrow-scope API key on a super account, or a non-super account whose ACL includes api.users.write, can force-disable two-factor authentication on any non-super target account via POST /api/v1/users/{user}/2fa/disable without providing a TOTP code, facilitating account takeover.

Defensive priority

CVE-2026-72822 is rated HIGH with a CVSS score of 8.7; verify and apply vendor patches immediately.

Recommended defensive actions

• Verify and apply the vendor patch to update the getgrav/grav-plugin-api Composer package to version 1.0.13 or later.
• Review and restrict API key scopes to prevent unauthorized access.
• Implement additional monitoring to detect potential exploitation attempts.
• Conduct an inventory check to identify affected systems and prioritize remediation.
• Consider compensating controls, such as IP restrictions or rate limiting, until patching is complete.

Evidence notes

The getgrav/grav-plugin-api Composer package before 1.0.13 fails to enforce API key scope caps on the disable2fa endpoint. A holder of a narrow-scope API key on a super account, or a non-super account whose ACL includes api.users.write, can force-disable two-factor authentication on any non-super target account via POST /api/v1/users/{user}/2fa/disable without providing a TOTP code, facilitating account takeover. Evidence is based on CVE and NVD records; further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.