The vulnerable Grav API allows an actor with a narrow‑scope API key to disable two‑factor authentication on any target user without providing a TOTP. The flaw results from the disable2fa endpoint bypassing API key scope caps and never invoking requirePermission. As a consequence, an attacker can force‑disable 2FA and gain unauthorized access as the target user, effectively taking over their account. This represents a severe identity compromise and is classified as CWE‑306.

The issue affects the Grav CMS (getgrav:grav) and its grav‑plugin‑api package prior to version 1.0.13, specifically all releases up to and including 1.0.12. Administrators who rely on API keys that include api.users.write or that are tied to super‑admin accounts are vulnerable.

The CVSS score of 8.7 indicates high severity. The EPSS score is < 1%, indicating a low probability of exploitation, but the lack of a TOTP requirement and reliance solely on API key scope create a straightforward exploitation path. An attacker possessing a valid API key with limited scopes can POST to /api/v1/users/{user}/2fa/disable and immediately remove two‑factor protection. The vulnerability is not listed in the CISA KEV catalog, but its high impact warrants rapid mitigation.