CVE-2026-72822

The getgrav/grav-plugin-api Composer package (versions ≤ 1.0.12) contains an authentication bypass on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermis...

CVE-2026-72822 Grav before 1.0.13 Authentication Bypass via disable2fa

The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...

PT-2026-71991

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.13 Description The software fails to enforce API key scope caps on the disable2fa endpoint. While the generate2fa endpoint correctly applies these caps, disable2fa authorizes the admin path using...

CVE-2026-72822: Missing Authentication for Critical Function

The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...

CVE-2026-54418

CVE-2026-54418 affects Leantime up to version 3.6.2. The JSON-RPC endpoints leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA accept a caller-supplied userId without ownership checks, session pinning, or permission-attribute gating. An authenticated user can call ...

CVE-2026-62233: Authorization Bypass Through User-Controlled Key

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...