CVE-2026-72822

The record

The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermission(), so the api_key_scopes cap is never applied. As a result, a holder of a narrow-scope API key on a super account, or a non-super account whose ACL includes api.users.write, can force-disable two-factor authentication on any non-super target account via POST /api/v1/users/{user}/2fa/disable without providing a TOTP code, facilitating account takeover.

Affected packages

Related vulnerabilities

• CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes… CWE-306
• CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-306
• CVE-2026-53714 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or… CWE-306
• CVE-2026-89261 MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search… CWE-306
• CVE-2026-89250 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an… CWE-306
• CVE-2026-89176 WeenyGenius, a computer lab management system developed by Howyar Technologies, has a… CWE-306
• CVE-2026-88285 GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without… CWE-306
• CVE-2026-87924 A security vulnerability has been detected in Rizwan17 inventory-management-system up to… CWE-306