getgrav/grav-plugin-api <= 1.0.12 Vulnerable to Account Takeover
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- getgrav/grav-plugin-api (packagist)
- Affected versions
- < 1.0.0-beta.15
- Patched version
- 1.0.13
The getgrav/grav-plugin-api Composer package before 1.0.13 is vulnerable to account takeover due to a failure to enforce API key scope caps on the disable2fa endpoint. Users of versions <= 1.0.12 are affected.
What happened
The getgrav/grav-plugin-api package before version 1.0.13 does not properly enforce API key scope restrictions on the disable2fa endpoint. This allows an attacker with a narrow-scope API key on a super account, or a non-super account with appropriate ACLs, to disable two-factor authentication on any non-super target account without providing a TOTP code. This facilitates account takeover.
This vulnerability was first flagged on 2026-08-14T12:16:45.267000+00:00 and confirmed shortly thereafter. It has a CVSS score of 9.8, indicating a critical severity level.
What to do about it
- Upgrade getgrav/grav-plugin-api to version 1.0.13 or later to mitigate the risk of account takeover.
- Review your API key scopes and ACL configurations to ensure they align with the principle of least privilege.
- Monitor your systems for any unauthorized account activity following the upgrade.
How 0Day would have caught this
getgrav/grav-plugin-api is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using getgrav/grav-plugin-api version 1.0.12 or earlier.
What should I do right now?
Upgrade to getgrav/grav-plugin-api version 1.0.13 or later immediately.
Has this been exploited in the wild?
There is no evidence that this vulnerability has been exploited in the wild at this time.