An authentication bypass in the grav-plugin-api allows unauthorized users to disable two-factor authentication on target accounts, facilitating full account takeover.

The disable2fa endpoint fails to invoke necessary permission checks, allowing users with limited API access to bypass security controls. This permits the disabling of two-factor authentication on non-super accounts without requiring a TOTP code.

By enabling the removal of two-factor authentication, an attacker can effectively bypass the primary protection mechanism for user accounts. This facilitates account takeover, which can lead to unauthorized administrative access and potential data breaches. The CVSS score of 9.8 reflects the ease of exploitation and the high impact on account security.

Immediate Action: Update the getgrav grav-plugin-api component to version 1.0.13 or later. This version correctly enforces API key scope caps and mandatory permission checks for the disable2fa endpoint.

Proactive Monitoring: Review logs for unusual calls to the /api/v1/users/{user}/2fa/disable endpoint. Monitor for unexpected modifications to user account security settings, particularly the removal of 2FA.

Compensating Controls: Restrict access to the API endpoints via network-level controls or WAF rules if immediate patching is not feasible. Audit existing API keys to ensure they adhere to the principle of least privilege.

Public Exploit Available: Unknown

The ability to bypass 2FA is a major security risk that should be addressed immediately. Organizations using the Grav API plugin must update to version 1.0.13 to prevent potential account takeovers and maintain the security posture of their administrative users.