Authentication Bypass in Grav Plugin Affects Admin Accounts
CVE-2026-72822

9.3CRITICAL

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
14 August 2026

What is CVE-2026-72822?

The Grav Plugin API version prior to 1.0.13 contains a vulnerability that allows an attacker to bypass two-factor authentication (2FA) for user accounts. This issue arises because the disable2fa endpoint does not enforce the correct API key scope restrictions. Unlike the secure generate2fa endpoint, disable2fa relies solely on access control list (ACL) checks without invoking required permission validations. As a result, users with limited access tokens, including non-super users with certain permissions, can disable 2FA for any target account without the need for a time-based one-time password (TOTP), making it easier for attackers to take over accounts.

Affected Version(s)

grav 0 < 1.0.13

grav 1.0.13

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/grav-before-authenti...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.