CVE-2026-72822 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record

■ Executive Risk Command Center

Urgent exposure review? — YES — CVSS ≥ 9.0 (Critical)

► Executive Summary

The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermission(), so the api_key_scopes cap is. This represents a CRITICAL-severity threat (CVSS 9.8 risk profile) requiring immediate evaluation by SOC and vulnerability management teams.

This item is not present in the verified CISA KEV catalog snapshot; absence does not rule out exploitation. CYBERDUDEBIVASH® SENTINEL APEX has classified this as a priority intelligence item warranting evaluation.

► Verified Facts

► Threat Classification & Severity

Exploitability: Active exploitation not confirmed in CISA KEV at time of publication — technical severity assessed independently of exploitation status (MEDIUM CONFIDENCE)
Impact scope: Unauthorized account access, financial fraud, identity theft, regulatory breach notification obligation
Prevalence: Broad exposure — all organizations running the affected software or exposed services
Attribution: Attribution to specific threat actors has not been confirmed in the source material — analyst assessment and sector context are the basis for any attribution statements in this report (LOW CONFIDENCE).

► Business Impact

Credential stuffing ATO incidents carry average costs of $290K per incident (Ponemon Institute) including fraud remediation, breach notification, and regulatory fines. GDPR Article 83 fines up to €20M or 4% of global annual revenue apply if personal data is accessed. PCI-DSS 4.0 Section 8 requires MFA for all account access — non-compliance creates direct audit liability.

Risk quantification requires correlation against your specific asset inventory, data classification, and regulatory obligations. CVSS scores reflect technical severity, not business impact to your environment.

► Technical Analysis

The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermission(), so the api_key_scopes cap is never applied. As a result, a holder of a narrow-scope API key on a super account, or a non-super account whose ACL includes api.users.write, can force-disable two-factor authentication on any non-super target account via POST /api/v1/users/{user}/2fa/disable without providing a TOTP code, facilitating account takeover. CVSS Score: 9.8 CWE: CWE-306

Credential stuffing operations rely on the reuse of username/password pairs from prior data breaches — victims are compromised through no fault of their current security posture. The attack succeeds entirely because of credential reuse across services, making MFA enforcement the single highest-efficacy defensive control available.

► CVE Analysis

► Executive Decision Matrix

PRIORITY	DECISION REQUIRED	OWNER	TIMELINE
P0	Authorize emergency patching of CVE-2026-72822 — override change management freeze if required	CISO / IT Operations	Immediate
P0	Authorize WAF virtual patching deployment if patch is not available within 4 hours	CISO / Security Architect	Within 4 hours
P1	Authorize retroactive log review to determine if pre-patch exploitation occurred	CISO / SOC Lead	Within 24 hours
P2	Assess whether asset inventory process needs improvement to accelerate future CVE exposure identification	CISO / VP Engineering	Within 30 days

► Executive Recommendations

► Predictive Intelligence

► MSSP Partner Advisory

MSSPs must immediately assess all client attack surfaces for CVE-2026-72822 exposure using asset inventory cross-reference. Issue P1 priority advisory to all clients in healthcare, financial services, technology, and government sectors — sectors with the highest concentration of internet-facing vulnerable applications. Provide WAF virtual patching rules for clients unable to patch immediately. CYBERDUDEBIVASH® SENTINEL APEX KEV integration provides real-time CISA KEV tracking with automated client exposure scoring against asset inventories.

► SENTINEL APEX Intelligence Correlation

► Long-Term Strategic Risk

The window between CVE publication and weaponization continues to compress — threat actors are demonstrating exploitation capability within hours of CVE disclosure for high-value targets. Vulnerabilities like CVE-2026-72822 represent the most efficient initial access vector available. Organizations must integrate real-time CISA KEV tracking with automated asset-to-vulnerability correlation to operationalize patch prioritization before weaponization, not after. CYBERDUDEBIVASH® SENTINEL APEX KEV correlation provides risk scoring against your specific asset inventory at time of CVE publication.

► References