CVE-2026-72822 is an authorization flaw in the Grav API plugin. The disable2fa endpoint skipped the API key scope check, so a narrow key could turn off two factor authentication on other accounts without a code. The record scores it 8.8, High. Upgrade getgrav/grav-plugin-api to 1.0.13.
What's affected
The record says the getgrav/grav-plugin-api Composer package is affected before 1.0.13. The GitHub advisory lists affected versions as 1.0.12 and earlier, with 1.0.13 as the patched release.
The advisories share one root cause. The plugin enforces its API key scope limits in a single place, inside a permission check that runs before the super user shortcut. Several controllers instead use a bare super user check that reads the account setting directly and never looks at the key's scopes. A least privilege key created on a super account therefore passes any of those bare checks and its scope limit is skipped. In this case the disable2fa endpoint authorizes the admin path by reading access rules only. Its sibling generate2fa endpoint calls the proper permission check, but disable2fa never does. A holder of a narrow scope key on a super account, or of a key on a non-super account with api.users.write in its access list, can disable two factor authentication on any non-super target account without a one time code. The record notes this makes account takeover easier.
The weakness class is CWE-306, missing authentication for a critical function.
How to check if you're exposed
Check the version of the Grav API plugin on every site.
composer show getgrav/grav-plugin-api
If you installed the plugin through the Grav package manager instead of Composer, read the version from the plugin's own files or the plugin list in the Grav admin. Any version up to 1.0.12 is affected. Then check whether you have issued scoped API keys. The advisory explains that the weakness depends on a key with limited scopes that was created on a super user account, or on an account that holds the api.users.write permission in its access list. If nobody uses API keys, your exposure is smaller, but upgrade anyway.
What to do now
- Upgrade getgrav/grav-plugin-api to 1.0.13 or later.
- List all API keys on each site, and delete the ones you no longer use.
- Check which accounts have the api.users.write permission, and remove it where it is not needed.
- Review whether two factor authentication is still enabled on your administrator and editor accounts, and re-enable it if it was turned off.
- Look at the audit trail or web logs for calls to the two factor disable route that you did not expect.
- Reset passwords on accounts where two factor was turned off without your knowledge.
Why it matters
The advisories share one root cause. The plugin enforces its API key scope limits in a single place, inside a permission check that runs before the super user shortcut. Several controllers instead use a bare super user check that reads the account setting directly and never looks at the key's scopes. A least privilege key created on a super account therefore passes any of those bare checks and its scope limit is skipped.
Two factor authentication exists to protect an account when the password is lost. An endpoint that switches it off without a code defeats that purpose, because an attacker who then learns or resets the password has no second barrier.
The record scores this High under CVSS 3.1. The GitHub advisory also labels it High, while VulnCheck lists it as critical under CVSS 4.0 with a score of 9.3. If you use scoped API keys as a security control, read the VulnCheck rating as the more accurate one. No source reports exploitation in the wild, and the CVE is not in the CISA KEV catalog. The advisory also notes that an earlier fix, for CVE-2026-65897 and CVE-2026-65895, covered only four controllers, which shows that this class of mistake can recur when each controller carries its own check.
Quick check
Does the attacker need a one time code?
No. The advisory says the admin path of disable2fa does not require a TOTP code.
Which version fixes it?
getgrav/grav-plugin-api 1.0.13. Versions up to 1.0.12 are listed as affected.
Sources
Last reviewed: 18 October 2026.
