The getgrav/grav-plugin-api package before version 1.0.13 fails to enforce API key scope restrictions on the disable2fa endpoint. While the generate2fa endpoint properly requires permission checks, disable2fa authorizes requests based only on ACL reads (isSuperAdmin/hasPermission) and does not invoke requirePermission(), thus bypassing api_key_scopes enforcement. Consequently, an attacker holding a narrow-scope API key on a super account or a non-super account with api.users.write permission can disable 2FA on any non-super user via a POST request to /api/v1/users/{user}/2fa/disable without needing a TOTP code, facilitating account takeover.

An attacker with limited API key scope but sufficient ACL permissions can disable two-factor authentication on targeted non-super user accounts without providing a TOTP code. This bypass of 2FA protections significantly increases the risk of account takeover, compromising user accounts and potentially leading to unauthorized access and control within the affected Grav environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided at this time. Until a fix is available, restrict API key permissions to trusted users only and monitor for suspicious API activity related to 2FA disablement endpoints.