Description

The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermission(), so the api_key_scopes cap is never applied. As a result, a holder of a narrow-scope API key on a super account, or a non-super account whose ACL includes api.users.write, can force-disable two-factor authentication on any non-super target account via POST /api/v1/users/{user}/2fa/disable without providing a TOTP code, facilitating account takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-14T12:16:45.267Z",
  "pubdate": "2026-08-14T12:16:45.267Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the getgrav/grav-plugin-api Composer package in versions prior to 1.0.13, specifically affecting the disable2fa endpoint. The vulnerability stems from a failure to enforce API key scope caps during administrative operations. An attacker holding a narrow-scope API key on a super account, or possessing a non-super account with appropriate ACL permissions such as api.users.write, can force-disable two-factor authentication on arbitrary non-super target accounts without providing a valid TOTP code. The impact of this security flaw includes complete account takeover, leading to unauthorized administrative access and system compromise. The vulnerability requires valid authentication credentials with specific ACL permissions or restricted API keys to execute the attack flow, but bypasses intended granular scope restrictions enforced on sibling endpoints such as generate2fa.",
  "technicalDetails": "The vulnerability resides within the API endpoint handling two-factor authentication deactivation, specifically accessed via the HTTP POST method at /api/v1/users/{user}/2fa/disable. The root cause of the flaw is an inconsistent authorization and scope enforcement mechanism within the codebase. Unlike the sibling generate2fa endpoint, which correctly invokes the requirePermission() function to validate and apply the api_key_scopes restrictions, the disable2fa endpoint authorizes the administrative modification path solely via Access Control List (ACL) read checks such as isSuperAdmin() or hasPermission(). Because requirePermission() is never invoked during the execution of disable2fa, the defined api_key_scopes cap is entirely bypassed.\nThe affected component is the getgrav/grav-plugin-api Composer package for Grav CMS, specifically impacting versions 1.0.12 and all prior iterations. Exploitation occurs when an authenticated user—either possessing a narrow-scope API key tied to a super-administrator account or holding a non-super account whose ACL contains the api.users.write permission—issues a crafted POST request to the vulnerable disable2fa URI path targeting a specified non-super user account. Due to the absence of scope validation and the lack of a mandatory TOTP code verification requirement in this specific execution context, the application processes the request and successfully strips two-factor authentication protection from the target account.\nThe attack flow proceeds as follows: First, the adversary authenticates using an API key or account credentials that satisfy the baseline ACL reads (isSuperAdmin/hasPermission) but violate the intended narrow scope caps. Second, the adversary targets a designated non-super user account by formulating the POST request to the disable2fa endpoint. Third, the backend controller processes the request, validates the basic ACL read permissions, skips the missing requirePermission() enforcement check, and bypasses the api_key_scopes evaluation. Finally, the application forces the deactivation of two-factor authentication for the victim account without requesting or verifying a TOTP token.\nThe post-exploitation impact facilitates immediate account takeover. By stripping two-factor authentication from the target non-super account, the attacker can leverage the compromised account to escalate privileges, manipulate system configurations, or execute further malicious actions depending on the underlying permissions associated with the targeted user profile."
}