Missing scope enforcement on disable2fa endpoint in getgrav/grav-plugin-api (CVE-2026-72822)

The grav-plugin-api Composer package fails to invoke requirePermission() on the admin (non-self) path of the disable2fa endpoint, meaning the api_key_scopes cap is never applied. A holder of a narrow-scope API key on a super account, or a non-super account whose ACL includes api.users.write, can force-disable two-factor authentication on any non-super target account via POST /api/v1/users/{user}/2fa/disable without supplying a TOTP code. This facilitates account takeover against any non-super user. Affected versions: - <= 1.0.12 We recommend updating to: 1.0.13. CVSS 9.3 · our assessment: act_now Reference: https://github.com/getgrav/grav/security/advisories/GHSA-22p9-6fh4-mmf2 Details: https://vuln.today/cve/CVE-2026-72822