Grav API Plugin CVE-2026-72822

The attacker must possess a valid API key meeting one of two criteria: (a) the key is associated with a non-super account whose ACL includes api.users.write permission, or (b) the key is any scoped key associated with a super account, since api_key_scopes caps are never enforced on the disable2fa path regardless of declared scope. The target of the attack must be a non-super user account - super accounts cannot be targeted via this endpoint. The grav-plugin-api plugin must be installed at version 1.0.12 or earlier, and the /api/v1/users/{user}/2fa/disable endpoint must be network-accessible. The attacker must know or enumerate a valid non-super username. Key limiting factors: a valid authenticated API key is required (PR:L - unauthenticated exploitation is not possible); super accounts are not targetable; and exploitation depends on the plugin being installed, which is not a default Grav configuration.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:L) reflects network-accessible exploitation requiring only a valid API key with no complexity barriers beyond credential possession. SSVC signals amplify concern: the attack is rated Automatable with Total Technical Impact, meaning exploitation can be scripted at scale against any environment exposing the Grav API with delegated write-scoped keys. Countering this urgency is an EPSS score of 0.34% (28th percentile), indicating low near-term exploitation probability; SSVC also lists Exploitation as 'none', consistent with no CISA KEV entry and no identified public proof-of-concept. The divergence between high CVSS and SSVC Technical Impact versus low EPSS and exploitation status suggests a real architectural flaw that has not yet attracted active attacker attention - a common pattern for CMS plugin vulnerabilities requiring non-default plugin installation. Priority should be high for deployments using API keys with delegated write permissions, and lower for internally-only or air-gapped Grav instances where the API surface is not externally reachable.

An attacker holding a narrow-scope API key - obtained through credential theft, a key leaked in a public repository, or insider access - sends a crafted POST request to /api/v1/users/{target_username}/2fa/disable targeting a non-super Grav account. The missing requirePermission() call allows the request to succeed regardless of the key's declared scope, stripping 2FA from the target account without requiring a TOTP code. The attacker then authenticates to the Grav admin panel using only the target user's password, achieving full account takeover.