Skip to main content

Grav API Plugin CVE-2026-72822

| EUVDEUVD-2026-58636 HIGH
Missing Authentication for Critical Function (CWE-306)
2026-08-14 VulnCheck GHSA-993x-642g-h4x5
Authentication Bypass Grav
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.6 CRITICAL

Network-accessible (AV:N), low complexity (AC:L), valid API key required (PR:L), attack modifies other users' accounts constituting a scope change (S:C), no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

7
Analysis Updated
Aug 24, 2026 - 11:37 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 24, 2026 - 11:22 vuln.today
cvss_changed
Severity Changed
Aug 24, 2026 - 11:22 NVD
CRITICAL HIGH
CVSS changed
Aug 24, 2026 - 11:22 NVD
9.3 (CRITICAL) 8.7 (HIGH)
Patch available
Aug 14, 2026 - 13:01 EUVD
Analysis Generated
Aug 14, 2026 - 12:31 vuln.today
CVE Published
Aug 14, 2026 - 11:35 cve.org
CRITICAL 9.3

DescriptionCVE.org

The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermission(), so the api_key_scopes cap is never applied. As a result, a holder of a narrow-scope API key on a super account, or a non-super account whose ACL includes api.users.write, can force-disable two-factor authentication on any non-super target account via POST /api/v1/users/{user}/2fa/disable without providing a TOTP code, facilitating account takeover.

AnalysisAI

Force-disabling of two-factor authentication on Grav CMS user accounts is achievable through a missing scope enforcement check in the grav-plugin-api Composer package before version 1.0.13. Any holder of a low-privilege API key carrying api.users.write permission - or any scoped key on a super account - can POST to /api/v1/users/{user}/2fa/disable without supplying a TOTP code, stripping 2FA from any non-super target account and enabling direct account takeover. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain or compromise API key with api.users.write
Delivery
Enumerate valid non-super Grav username
Exploit
POST /api/v1/users/{user}/2fa/disable without TOTP code
Execution
2FA silently removed from target account
Persist
Authenticate to Grav admin with target's password alone
Impact
Full account takeover achieved
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must possess a valid API key meeting one of two criteria: (a) the key is associated with a non-super account whose ACL includes api.users.write permission, or (b) the key is any scoped key associated with a super account, since api_key_scopes caps are never enforced on the disable2fa path regardless of declared scope. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:L) reflects network-accessible exploitation requiring only a valid API key with no complexity barriers beyond credential possession. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker holding a narrow-scope API key - obtained through credential theft, a key leaked in a public repository, or insider access - sends a crafted POST request to /api/v1/users/{target_username}/2fa/disable targeting a non-super Grav account. The missing requirePermission() call allows the request to succeed regardless of the key's declared scope, stripping 2FA from the target account without requiring a TOTP code. …
Remediation Upgrade grav-plugin-api to version 1.0.13 or later, which introduces proper requirePermission() enforcement on the disable2fa endpoint, aligning it with the sibling generate2fa endpoint. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Grav CMS instances with API exposure and audit the distribution of delegated API keys across your organization. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Grav

View all
CVE-2025-66294 HIGH POC
8.8 Dec 01

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists

CVE-2025-66301 CRITICAL POC
9.6 Dec 01

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical

CVE-2025-50286 HIGH POC
8.1 Aug 06

A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
CVE-2024-34082 CRITICAL POC
9.9 May 15

Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
CVE-2021-47812 CRITICAL POC
9.8 Jan 16

GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
CVE-2025-66297 HIGH POC
8.8 Dec 01

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or e
CVE-2025-66299 HIGH POC
8.8 Dec 01

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
CVE-2024-28119 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
CVE-2024-28118 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
CVE-2024-28117 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
CVE-2024-28116 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
CVE-2024-27921 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2024-51567 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-32433 CRITICAL POC
10.0
CVE-2016-2004 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-72822 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy