External risk intelligence

Grav API Key Scope Bypass Allows 2FA Disablement

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-72822

The vulnerability exists in a Grav CMS API endpoint used for user management. Grav is a web application commonly deployed as an internet-facing service. Since the API surface is accessible to facilitate administrative tasks and user interactions, it is frequently exposed to the network in typical web server deployments.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a flaw in a Grav CMS API plugin that could allow unauthorized disabling of multi-factor authentication, potentially leading to account takeover. The vulnerability stems from insufficient access controls on a specific endpoint, enabling attackers to bypass security requirements. Understanding the potential for unauthorized access is key for leadership to assess risk.

Security flaw allows bypassing multi-factor authentication.
It could lead to unauthorized account access.
Assess exposure and confirm relevance to your systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted POST request to the disable2fa endpoint. This bypasses the need for a Two-Factor Authentication (2FA) code and allows an attacker to disable 2FA on a target account. The vulnerability lies in how the API key scope is handled, specifically that it's not enforced for disabling 2FA, potentially leading to unauthorized account access.

No special access or authentication needed.
Triggered by a POST request to disable2fa.
Risk of unauthorized account takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to disable two-factor authentication (2FA) for non-super user accounts. This is possible when an attacker holds a narrow-scope API key on a super account, or a non-super account with specific write permissions. By sending a POST request to the `/api/v1/users/{user}/2fa/disable` endpoint without a TOTP code, an attacker could bypass the standard 2FA verification and facilitate account takeover.

User accounts without super admin status.
Bypassing 2FA via a crafted API request.
Potential for unauthorized account takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the getgrav/grav-plugin-api Composer package, specifically related to API key scope enforcement for disabling two-factor authentication. It allows unauthorized users to disable 2FA on other accounts, potentially leading to account takeover. Action should be initiated by the team responsible for the Grav CMS deployment, likely application owners or platform teams. The first step is to identify all instances of the affected package, assess their exposure and business criticality, and then plan remediation, possibly involving vendor coordination.

Identify affected Grav CMS instances.
Verify API key scope configurations.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the getgrav/grav-plugin-api package?

It is a core component of the Grav Content Management System, a file-based platform used to build flexible, high-performance websites. This specific API plugin provides the interface for external applications and administrative tools to manage Grav site data, including user accounts and security settings, via programmed requests rather than the standard web dashboard.

What does CWE-306 mean for CVE-2026-72822?

CWE-306 refers to a Missing Authentication for Critical Function vulnerability. In this case, the software fails to properly check if an API user is authorized to perform a sensitive action—specifically, disabling two-factor authentication (2FA). Because the system does not verify the required permissions for the disable2fa endpoint, it inadvertently allows unauthorized changes to security settings.

How is this vulnerability triggered?

An attacker triggers the flaw by sending a specific POST request to the API's disable2fa endpoint. Crucially, the request does not require a valid multi-factor authentication token or the super-admin status typically needed for such sensitive changes. The vulnerability is not triggered by standard site usage, but rather through direct interaction with the API endpoint using a compromised or improperly scoped API key.

Do I need to worry if my Grav site is not internet-facing?

According to Halo Surface Signal, this vulnerability is most relevant to internet-facing Grav deployments, where the API surface is easily reachable by external actors. If your instance is strictly internal and isolated from the public internet, the practical risk is lower, though it remains a concern if a malicious actor gains access to your internal network or uses a compromised account to reach the API.

What are the first steps to address this issue?

Begin by auditing your current environment to locate all Grav CMS installations using the affected plugin versions. Prioritize updating the getgrav/grav-plugin-api package to a version that enforces proper API key scope checks. While preparing the update, review existing API keys for excessive privileges and consider restricting network access to the API endpoints if those services do not need to be publicly reachable.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.