Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-86196 (GCVE-0-2026-86196)

Vulnerability from nvd – Published: 2026-09-05 12:09 – Updated: 2026-09-05 12:09

Title

Grav API Plugin before 1.0.20 Authentication Bypass via Host Header

Summary

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-290 - Authentication Bypass by Spoofing

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	vendor-advisory
https://www.vulncheck.com/advisories/grav-api-plu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: 0 , < 1.0.20 (semver) Unaffected: 1.0.20 (semver) cpe:2.3:a:getgrav:grav::::::::

Date Public

2026-08-21 00:00

Credits

1K0CT

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "lessThan": "1.0.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.0.20",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.0.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1K0CT"
        }
      ],
      "datePublic": "2026-08-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-05T12:09:09.490Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-262p-56vv-7v5r)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-262p-56vv-7v5r"
        },
        {
          "name": "VulnCheck Advisory: Grav API Plugin before 1.0.20 Authentication Bypass via Host Header",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/grav-api-plugin-before-1.0.20-authentication-bypass-via-host-header"
        }
      ],
      "title": "Grav API Plugin before 1.0.20 Authentication Bypass via Host Header",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86196",
    "datePublished": "2026-09-05T12:09:09.490Z",
    "dateReserved": "2026-09-05T11:52:36.821Z",
    "dateUpdated": "2026-09-05T12:09:09.490Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86195 (GCVE-0-2026-86195)

Vulnerability from nvd – Published: 2026-09-05 12:09 – Updated: 2026-09-05 12:09

Title

grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag

Summary

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write permissions can create an invitation with a dot-keyed super flag in the access payload that bypasses the guard and persists to the new account. Attackers can accept the invitation through the public endpoint without real invitee interaction to create a super-admin account and immediately receive a valid JWT for full site control.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-269 - Improper Privilege Management

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	vendor-advisory
https://www.vulncheck.com/advisories/grav-plugin-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: 0 , < 1.0.20 (semver) Unaffected: 1.0.20 (semver) cpe:2.3:a:getgrav:grav::::::::

Date Public

2026-08-21 00:00

Credits

1K0CT

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "lessThan": "1.0.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.0.20",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.0.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1K0CT"
        }
      ],
      "datePublic": "2026-08-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write permissions can create an invitation with a dot-keyed super flag in the access payload that bypasses the guard and persists to the new account. Attackers can accept the invitation through the public endpoint without real invitee interaction to create a super-admin account and immediately receive a valid JWT for full site control."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-05T12:09:08.807Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m363-3hww-gcwc)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-m363-3hww-gcwc"
        },
        {
          "name": "VulnCheck Advisory: grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/grav-plugin-api-1.0.0-through-1.0.19-privilege-escalation-via-dot-keyed-super-flag"
        }
      ],
      "title": "grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86195",
    "datePublished": "2026-09-05T12:09:08.807Z",
    "dateReserved": "2026-09-05T11:51:31.102Z",
    "dateUpdated": "2026-09-05T12:09:08.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86193 (GCVE-0-2026-86193)

Vulnerability from nvd – Published: 2026-09-05 12:09 – Updated: 2026-09-05 12:09

Title

Grav API Plugin Authentication Bypass via Group-Inherited Super

Summary

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	vendor-advisory
https://www.vulncheck.com/advisories/grav-api-plu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: 0 , < 1.0.20 (semver) Unaffected: 1.0.20 (semver) cpe:2.3:a:getgrav:grav::::::::

Date Public

2026-08-21 00:00

Credits

1K0CT

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "lessThan": "1.0.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.0.20",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.0.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1K0CT"
        }
      ],
      "datePublic": "2026-08-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-05T12:09:07.441Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vv8m-jqpm-38x4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-vv8m-jqpm-38x4"
        },
        {
          "name": "VulnCheck Advisory: Grav API Plugin Authentication Bypass via Group-Inherited Super",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/grav-api-plugin-authentication-bypass-via-group-inherited-super"
        }
      ],
      "title": "Grav API Plugin Authentication Bypass via Group-Inherited Super",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86193",
    "datePublished": "2026-09-05T12:09:07.441Z",
    "dateReserved": "2026-09-05T11:51:31.102Z",
    "dateUpdated": "2026-09-05T12:09:07.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64852 (GCVE-0-2026-64852)

Vulnerability from nvd – Published: 2026-08-19 16:00 – Updated: 2026-08-19 17:25

Title

Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-19 17:21 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit…	x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64852",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T17:21:44.414994Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T17:25:09.087Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target\u0027s API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:00:06.335Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/commit/ed16f0aaa9b398c6f179fb8f51e0fa53e4ed8a30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/commit/ed16f0aaa9b398c6f179fb8f51e0fa53e4ed8a30"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.8"
        }
      ],
      "source": {
        "advisory": "GHSA-7v74-m76q-8wf3",
        "discovery": "UNKNOWN"
      },
      "title": "Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-64852",
    "datePublished": "2026-08-19T16:00:06.335Z",
    "dateReserved": "2026-07-20T18:31:39.291Z",
    "dateUpdated": "2026-08-19T17:25:09.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63408 (GCVE-0-2026-63408)

Vulnerability from nvd – Published: 2026-08-19 15:53 – Updated: 2026-08-19 18:18

Title

Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-19 18:17 UTC

CWE

CWE-598 - Use of GET Request Method With Sensitive Query Strings

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit…	x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.0-rc.16

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63408",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T18:17:25.345538Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T18:18:38.809Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.0-rc.16"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content.  Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner\u0027s API privileges. This issue is fixed in version 1.0.0-rc.16."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "CWE-598: Use of GET Request Method With Sensitive Query Strings",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T15:53:08.681Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/commit/56ae2ca3bf36c8299a4b3d376c6a20e8c0ed5ba9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/commit/56ae2ca3bf36c8299a4b3d376c6a20e8c0ed5ba9"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.0-rc.16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.0-rc.16"
        }
      ],
      "source": {
        "advisory": "GHSA-4hpj-wmpw-ghwq",
        "discovery": "UNKNOWN"
      },
      "title": "Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63408",
    "datePublished": "2026-08-19T15:53:08.681Z",
    "dateReserved": "2026-07-16T19:20:28.987Z",
    "dateUpdated": "2026-08-19T18:18:38.809Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63407 (GCVE-0-2026-63407)

Vulnerability from nvd – Published: 2026-08-19 15:51 – Updated: 2026-08-25 02:12

Title

Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticated /api/v1 endpoints. JavaScript from any origin can submit an attacker-obtained JWT through the Authorization or X-API-Token header, read the authenticated response, and perform write operations with the token owner's privileges, enabling data exfiltration and account modification. This issue is fixed in version 1.0.0-rc.16.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 02:11 UTC

CWE

CWE-942 - Permissive Cross-domain Policy with Untrusted Domains

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit…	x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.0-rc.16

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63407",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T02:11:12.693870Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T02:12:10.329Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-93px-98wh-6fj2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.0-rc.16"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticated /api/v1 endpoints. JavaScript from any origin can submit an attacker-obtained JWT through the Authorization or X-API-Token header, read the authenticated response, and perform write operations with the token owner\u0027s privileges, enabling data exfiltration and account modification. This issue is fixed in version 1.0.0-rc.16."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-942",
              "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T15:51:36.784Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-93px-98wh-6fj2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-93px-98wh-6fj2"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/commit/56ae2ca3bf36c8299a4b3d376c6a20e8c0ed5ba9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/commit/56ae2ca3bf36c8299a4b3d376c6a20e8c0ed5ba9"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.0-rc.16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.0-rc.16"
        }
      ],
      "source": {
        "advisory": "GHSA-93px-98wh-6fj2",
        "discovery": "UNKNOWN"
      },
      "title": "Grav API Plugin: CORS \u0027Access-Control-Allow-Origin: *\u0027 on Authenticated API Responses"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63407",
    "datePublished": "2026-08-19T15:51:36.784Z",
    "dateReserved": "2026-07-16T19:20:28.987Z",
    "dateUpdated": "2026-08-25T02:12:10.329Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62668 (GCVE-0-2026-62668)

Vulnerability from nvd – Published: 2026-08-19 15:29 – Updated: 2026-08-19 18:44

Title

Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-19 18:43 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit…	x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releas…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
getgrav	grav	Affected: < 2.0.4
getgrav	grav-plugin-api	Affected: < 1.0.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62668",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T18:43:58.407223Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T18:44:04.914Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.4"
            }
          ]
        },
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T15:29:24.452Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6"
        }
      ],
      "source": {
        "advisory": "GHSA-58q8-f7v4-w2vf",
        "discovery": "UNKNOWN"
      },
      "title": "Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62668",
    "datePublished": "2026-08-19T15:29:24.452Z",
    "dateReserved": "2026-07-14T20:22:04.394Z",
    "dateUpdated": "2026-08-19T18:44:04.914Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62667 (GCVE-0-2026-62667)

Vulnerability from nvd – Published: 2026-08-19 15:43 – Updated: 2026-08-25 02:10

Title

Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the owning user's complete identity. AbstractApiController::requirePermission() consequently evaluates the full user ACL, so a key issued for a read-only scope can perform every write, delete, and administrative operation available to the owner. This issue is fixed in version 1.0.6.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 02:08 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit…	x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62667",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T02:08:27.718833Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T02:10:10.736Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-x7hm-jc32-v39j"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the owning user\u0027s complete identity. AbstractApiController::requirePermission() consequently evaluates the full user ACL, so a key issued for a read-only scope can perform every write, delete, and administrative operation available to the owner. This issue is fixed in version 1.0.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T15:43:19.382Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-x7hm-jc32-v39j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-x7hm-jc32-v39j"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6"
        }
      ],
      "source": {
        "advisory": "GHSA-x7hm-jc32-v39j",
        "discovery": "UNKNOWN"
      },
      "title": "Grav API Plugin : API Key \u0027scopes\u0027 Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62667",
    "datePublished": "2026-08-19T15:43:19.382Z",
    "dateReserved": "2026-07-14T20:22:04.394Z",
    "dateUpdated": "2026-08-25T02:10:10.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62666 (GCVE-0-2026-62666)

Vulnerability from nvd – Published: 2026-08-19 15:36 – Updated: 2026-08-21 19:36

Title

Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApiKeyPermission(), obtain the target's full privileges because key scopes are not enforced, and create persistent super-administrator access; the same missing check also permits rotating or disabling the target's two-factor authentication. This issue is fixed in version 1.0.6.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 19:36 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit…	x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62666",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T19:36:08.240566Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T19:36:19.063Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApiKeyPermission(), obtain the target\u0027s full privileges because key scopes are not enforced, and create persistent super-administrator access; the same missing check also permits rotating or disabling the target\u0027s two-factor authentication. This issue is fixed in version 1.0.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T15:36:37.169Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-8gg4-rvvv-cq96",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-8gg4-rvvv-cq96"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6"
        }
      ],
      "source": {
        "advisory": "GHSA-8gg4-rvvv-cq96",
        "discovery": "UNKNOWN"
      },
      "title": "Grav API Plugin: non-super api.users.write manager -\u003e super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62666",
    "datePublished": "2026-08-19T15:36:37.169Z",
    "dateReserved": "2026-07-14T20:22:04.394Z",
    "dateUpdated": "2026-08-21T19:36:19.063Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-61607 (GCVE-0-2026-61607)

Vulnerability from nvd – Published: 2026-08-19 15:18 – Updated: 2026-08-21 19:35

Title

Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript, and the server returns the file as Content-Type: image/svg+xml so the script executes when a victim opens it, allowing session data theft and authenticated actions. This issue is fixed in version 1.0.2.

Severity

4.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 19:34 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit…	x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61607",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T19:34:32.482729Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T19:35:00.839Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-7vhm-8x52-2r5p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript, and the server returns the file as Content-Type: image/svg+xml so the script executes when a victim opens it, allowing session data theft and authenticated actions. This issue is fixed in version 1.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T15:18:15.354Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-7vhm-8x52-2r5p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-7vhm-8x52-2r5p"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/commit/d25eedb84a387f2c71b12a374f2a4b3d74339a7e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/commit/d25eedb84a387f2c71b12a374f2a4b3d74339a7e"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-7vhm-8x52-2r5p",
        "discovery": "UNKNOWN"
      },
      "title": "Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61607",
    "datePublished": "2026-08-19T15:18:15.354Z",
    "dateReserved": "2026-07-10T17:36:04.597Z",
    "dateUpdated": "2026-08-21T19:35:00.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42843 (GCVE-0-2026-42843)

Vulnerability from nvd – Published: 2026-05-11 15:54 – Updated: 2026-05-11 19:06

Title

grav-plugin-api: Grav API Privilege Escalation to Super Admin

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-11 18:51 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.0-beta.15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42843",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T18:51:01.009552Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-11T19:06:51.035Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.0-beta.15"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T15:54:33.485Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736"
        }
      ],
      "source": {
        "advisory": "GHSA-r945-h4vm-h736",
        "discovery": "UNKNOWN"
      },
      "title": "grav-plugin-api: Grav API Privilege Escalation to Super Admin"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42843",
    "datePublished": "2026-05-11T15:54:33.485Z",
    "dateReserved": "2026-04-30T16:44:48.376Z",
    "dateUpdated": "2026-05-11T19:06:51.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86196 (GCVE-0-2026-86196)

Vulnerability from cvelistv5 – Published: 2026-09-05 12:09 – Updated: 2026-09-05 12:09

Title

Grav API Plugin before 1.0.20 Authentication Bypass via Host Header

Summary

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-290 - Authentication Bypass by Spoofing

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	vendor-advisory
https://www.vulncheck.com/advisories/grav-api-plu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: 0 , < 1.0.20 (semver) Unaffected: 1.0.20 (semver) cpe:2.3:a:getgrav:grav::::::::

Date Public

2026-08-21 00:00

Credits

1K0CT

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "lessThan": "1.0.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.0.20",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.0.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1K0CT"
        }
      ],
      "datePublic": "2026-08-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-05T12:09:09.490Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-262p-56vv-7v5r)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-262p-56vv-7v5r"
        },
        {
          "name": "VulnCheck Advisory: Grav API Plugin before 1.0.20 Authentication Bypass via Host Header",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/grav-api-plugin-before-1.0.20-authentication-bypass-via-host-header"
        }
      ],
      "title": "Grav API Plugin before 1.0.20 Authentication Bypass via Host Header",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86196",
    "datePublished": "2026-09-05T12:09:09.490Z",
    "dateReserved": "2026-09-05T11:52:36.821Z",
    "dateUpdated": "2026-09-05T12:09:09.490Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86195 (GCVE-0-2026-86195)

Vulnerability from cvelistv5 – Published: 2026-09-05 12:09 – Updated: 2026-09-05 12:09

Title

grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag

Summary

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write permissions can create an invitation with a dot-keyed super flag in the access payload that bypasses the guard and persists to the new account. Attackers can accept the invitation through the public endpoint without real invitee interaction to create a super-admin account and immediately receive a valid JWT for full site control.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-269 - Improper Privilege Management

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	vendor-advisory
https://www.vulncheck.com/advisories/grav-plugin-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: 0 , < 1.0.20 (semver) Unaffected: 1.0.20 (semver) cpe:2.3:a:getgrav:grav::::::::

Date Public

2026-08-21 00:00

Credits

1K0CT

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "lessThan": "1.0.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.0.20",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.0.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1K0CT"
        }
      ],
      "datePublic": "2026-08-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write permissions can create an invitation with a dot-keyed super flag in the access payload that bypasses the guard and persists to the new account. Attackers can accept the invitation through the public endpoint without real invitee interaction to create a super-admin account and immediately receive a valid JWT for full site control."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-05T12:09:08.807Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m363-3hww-gcwc)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-m363-3hww-gcwc"
        },
        {
          "name": "VulnCheck Advisory: grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/grav-plugin-api-1.0.0-through-1.0.19-privilege-escalation-via-dot-keyed-super-flag"
        }
      ],
      "title": "grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86195",
    "datePublished": "2026-09-05T12:09:08.807Z",
    "dateReserved": "2026-09-05T11:51:31.102Z",
    "dateUpdated": "2026-09-05T12:09:08.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86193 (GCVE-0-2026-86193)

Vulnerability from cvelistv5 – Published: 2026-09-05 12:09 – Updated: 2026-09-05 12:09

Title

Grav API Plugin Authentication Bypass via Group-Inherited Super

Summary

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	vendor-advisory
https://www.vulncheck.com/advisories/grav-api-plu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: 0 , < 1.0.20 (semver) Unaffected: 1.0.20 (semver) cpe:2.3:a:getgrav:grav::::::::

Date Public

2026-08-21 00:00

Credits

1K0CT

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "lessThan": "1.0.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.0.20",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.0.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1K0CT"
        }
      ],
      "datePublic": "2026-08-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-05T12:09:07.441Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vv8m-jqpm-38x4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-vv8m-jqpm-38x4"
        },
        {
          "name": "VulnCheck Advisory: Grav API Plugin Authentication Bypass via Group-Inherited Super",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/grav-api-plugin-authentication-bypass-via-group-inherited-super"
        }
      ],
      "title": "Grav API Plugin Authentication Bypass via Group-Inherited Super",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86193",
    "datePublished": "2026-09-05T12:09:07.441Z",
    "dateReserved": "2026-09-05T11:51:31.102Z",
    "dateUpdated": "2026-09-05T12:09:07.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64852 (GCVE-0-2026-64852)

Vulnerability from cvelistv5 – Published: 2026-08-19 16:00 – Updated: 2026-08-19 17:25

Title

Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-19 17:21 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit…	x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64852",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T17:21:44.414994Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T17:25:09.087Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target\u0027s API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:00:06.335Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/commit/ed16f0aaa9b398c6f179fb8f51e0fa53e4ed8a30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/commit/ed16f0aaa9b398c6f179fb8f51e0fa53e4ed8a30"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.8"
        }
      ],
      "source": {
        "advisory": "GHSA-7v74-m76q-8wf3",
        "discovery": "UNKNOWN"
      },
      "title": "Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-64852",
    "datePublished": "2026-08-19T16:00:06.335Z",
    "dateReserved": "2026-07-20T18:31:39.291Z",
    "dateUpdated": "2026-08-19T17:25:09.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63408 (GCVE-0-2026-63408)

Vulnerability from cvelistv5 – Published: 2026-08-19 15:53 – Updated: 2026-08-19 18:18

Title

Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-19 18:17 UTC

CWE

CWE-598 - Use of GET Request Method With Sensitive Query Strings

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit…	x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.0-rc.16

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63408",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T18:17:25.345538Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T18:18:38.809Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.0-rc.16"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content.  Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner\u0027s API privileges. This issue is fixed in version 1.0.0-rc.16."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "CWE-598: Use of GET Request Method With Sensitive Query Strings",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T15:53:08.681Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/commit/56ae2ca3bf36c8299a4b3d376c6a20e8c0ed5ba9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/commit/56ae2ca3bf36c8299a4b3d376c6a20e8c0ed5ba9"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.0-rc.16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.0-rc.16"
        }
      ],
      "source": {
        "advisory": "GHSA-4hpj-wmpw-ghwq",
        "discovery": "UNKNOWN"
      },
      "title": "Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63408",
    "datePublished": "2026-08-19T15:53:08.681Z",
    "dateReserved": "2026-07-16T19:20:28.987Z",
    "dateUpdated": "2026-08-19T18:18:38.809Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63407 (GCVE-0-2026-63407)

Vulnerability from cvelistv5 – Published: 2026-08-19 15:51 – Updated: 2026-08-25 02:12

Title

Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticated /api/v1 endpoints. JavaScript from any origin can submit an attacker-obtained JWT through the Authorization or X-API-Token header, read the authenticated response, and perform write operations with the token owner's privileges, enabling data exfiltration and account modification. This issue is fixed in version 1.0.0-rc.16.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 02:11 UTC

CWE

CWE-942 - Permissive Cross-domain Policy with Untrusted Domains

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit…	x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.0-rc.16

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63407",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T02:11:12.693870Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T02:12:10.329Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-93px-98wh-6fj2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.0-rc.16"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticated /api/v1 endpoints. JavaScript from any origin can submit an attacker-obtained JWT through the Authorization or X-API-Token header, read the authenticated response, and perform write operations with the token owner\u0027s privileges, enabling data exfiltration and account modification. This issue is fixed in version 1.0.0-rc.16."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-942",
              "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T15:51:36.784Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-93px-98wh-6fj2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-93px-98wh-6fj2"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/commit/56ae2ca3bf36c8299a4b3d376c6a20e8c0ed5ba9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/commit/56ae2ca3bf36c8299a4b3d376c6a20e8c0ed5ba9"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.0-rc.16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.0-rc.16"
        }
      ],
      "source": {
        "advisory": "GHSA-93px-98wh-6fj2",
        "discovery": "UNKNOWN"
      },
      "title": "Grav API Plugin: CORS \u0027Access-Control-Allow-Origin: *\u0027 on Authenticated API Responses"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63407",
    "datePublished": "2026-08-19T15:51:36.784Z",
    "dateReserved": "2026-07-16T19:20:28.987Z",
    "dateUpdated": "2026-08-25T02:12:10.329Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62667 (GCVE-0-2026-62667)

Vulnerability from cvelistv5 – Published: 2026-08-19 15:43 – Updated: 2026-08-25 02:10

Title

Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the owning user's complete identity. AbstractApiController::requirePermission() consequently evaluates the full user ACL, so a key issued for a read-only scope can perform every write, delete, and administrative operation available to the owner. This issue is fixed in version 1.0.6.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 02:08 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit…	x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62667",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T02:08:27.718833Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T02:10:10.736Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-x7hm-jc32-v39j"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the owning user\u0027s complete identity. AbstractApiController::requirePermission() consequently evaluates the full user ACL, so a key issued for a read-only scope can perform every write, delete, and administrative operation available to the owner. This issue is fixed in version 1.0.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T15:43:19.382Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-x7hm-jc32-v39j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-x7hm-jc32-v39j"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6"
        }
      ],
      "source": {
        "advisory": "GHSA-x7hm-jc32-v39j",
        "discovery": "UNKNOWN"
      },
      "title": "Grav API Plugin : API Key \u0027scopes\u0027 Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62667",
    "datePublished": "2026-08-19T15:43:19.382Z",
    "dateReserved": "2026-07-14T20:22:04.394Z",
    "dateUpdated": "2026-08-25T02:10:10.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62666 (GCVE-0-2026-62666)

Vulnerability from cvelistv5 – Published: 2026-08-19 15:36 – Updated: 2026-08-21 19:36

Title

Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApiKeyPermission(), obtain the target's full privileges because key scopes are not enforced, and create persistent super-administrator access; the same missing check also permits rotating or disabling the target's two-factor authentication. This issue is fixed in version 1.0.6.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 19:36 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit…	x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62666",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T19:36:08.240566Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T19:36:19.063Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApiKeyPermission(), obtain the target\u0027s full privileges because key scopes are not enforced, and create persistent super-administrator access; the same missing check also permits rotating or disabling the target\u0027s two-factor authentication. This issue is fixed in version 1.0.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T15:36:37.169Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-8gg4-rvvv-cq96",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-8gg4-rvvv-cq96"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6"
        }
      ],
      "source": {
        "advisory": "GHSA-8gg4-rvvv-cq96",
        "discovery": "UNKNOWN"
      },
      "title": "Grav API Plugin: non-super api.users.write manager -\u003e super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62666",
    "datePublished": "2026-08-19T15:36:37.169Z",
    "dateReserved": "2026-07-14T20:22:04.394Z",
    "dateUpdated": "2026-08-21T19:36:19.063Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62668 (GCVE-0-2026-62668)

Vulnerability from cvelistv5 – Published: 2026-08-19 15:29 – Updated: 2026-08-19 18:44

Title

Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-19 18:43 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit…	x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releas…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
getgrav	grav	Affected: < 2.0.4
getgrav	grav-plugin-api	Affected: < 1.0.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62668",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T18:43:58.407223Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T18:44:04.914Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.4"
            }
          ]
        },
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T15:29:24.452Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-58q8-f7v4-w2vf"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/commit/dfcc947f0d6758772caac290c68fe8d4c4a4874e"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.6"
        }
      ],
      "source": {
        "advisory": "GHSA-58q8-f7v4-w2vf",
        "discovery": "UNKNOWN"
      },
      "title": "Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62668",
    "datePublished": "2026-08-19T15:29:24.452Z",
    "dateReserved": "2026-07-14T20:22:04.394Z",
    "dateUpdated": "2026-08-19T18:44:04.914Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-61607 (GCVE-0-2026-61607)

Vulnerability from cvelistv5 – Published: 2026-08-19 15:18 – Updated: 2026-08-21 19:35

Title

Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript, and the server returns the file as Content-Type: image/svg+xml so the script executes when a victim opens it, allowing session data theft and authenticated actions. This issue is fixed in version 1.0.2.

Severity

4.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 19:34 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit…	x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61607",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T19:34:32.482729Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T19:35:00.839Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-7vhm-8x52-2r5p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript, and the server returns the file as Content-Type: image/svg+xml so the script executes when a victim opens it, allowing session data theft and authenticated actions. This issue is fixed in version 1.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T15:18:15.354Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-7vhm-8x52-2r5p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-7vhm-8x52-2r5p"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/commit/d25eedb84a387f2c71b12a374f2a4b3d74339a7e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/commit/d25eedb84a387f2c71b12a374f2a4b3d74339a7e"
        },
        {
          "name": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-7vhm-8x52-2r5p",
        "discovery": "UNKNOWN"
      },
      "title": "Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61607",
    "datePublished": "2026-08-19T15:18:15.354Z",
    "dateReserved": "2026-07-10T17:36:04.597Z",
    "dateUpdated": "2026-08-21T19:35:00.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42843 (GCVE-0-2026-42843)

Vulnerability from cvelistv5 – Published: 2026-05-11 15:54 – Updated: 2026-05-11 19:06

Title

grav-plugin-api: Grav API Privilege Escalation to Super Admin

Summary

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-11 18:51 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/getgrav/grav/security/advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
getgrav	grav-plugin-api	Affected: < 1.0.0-beta.15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42843",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T18:51:01.009552Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-11T19:06:51.035Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grav-plugin-api",
          "vendor": "getgrav",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.0-beta.15"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site\u0027s content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attacker can exploit this to escalate their privileges to Super Administrator (admin.super and api.super), leading to full system compromise and potential RCE. This vulnerability is fixed in 1.0.0-beta.15."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T15:54:33.485Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-r945-h4vm-h736"
        }
      ],
      "source": {
        "advisory": "GHSA-r945-h4vm-h736",
        "discovery": "UNKNOWN"
      },
      "title": "grav-plugin-api: Grav API Privilege Escalation to Super Admin"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42843",
    "datePublished": "2026-05-11T15:54:33.485Z",
    "dateReserved": "2026-04-30T16:44:48.376Z",
    "dateUpdated": "2026-05-11T19:06:51.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

22 vulnerabilities found for grav-plugin-api by getgrav

CVE-2026-86196 (GCVE-0-2026-86196)

CVE-2026-86195 (GCVE-0-2026-86195)

CVE-2026-86193 (GCVE-0-2026-86193)

CVE-2026-64852 (GCVE-0-2026-64852)

CVE-2026-63408 (GCVE-0-2026-63408)

CVE-2026-63407 (GCVE-0-2026-63407)

CVE-2026-62668 (GCVE-0-2026-62668)

CVE-2026-62667 (GCVE-0-2026-62667)

CVE-2026-62666 (GCVE-0-2026-62666)

CVE-2026-61607 (GCVE-0-2026-61607)

CVE-2026-42843 (GCVE-0-2026-42843)

CVE-2026-86196 (GCVE-0-2026-86196)

CVE-2026-86195 (GCVE-0-2026-86195)

CVE-2026-86193 (GCVE-0-2026-86193)

CVE-2026-64852 (GCVE-0-2026-64852)

CVE-2026-63408 (GCVE-0-2026-63408)

CVE-2026-63407 (GCVE-0-2026-63407)

CVE-2026-62667 (GCVE-0-2026-62667)

CVE-2026-62666 (GCVE-0-2026-62666)

CVE-2026-62668 (GCVE-0-2026-62668)

CVE-2026-61607 (GCVE-0-2026-61607)

CVE-2026-42843 (GCVE-0-2026-42843)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

22 vulnerabilities found for grav-plugin-api by getgrav

CVE-2026-86196 (GCVE-0-2026-86196)

CVE-2026-86195 (GCVE-0-2026-86195)

CVE-2026-86193 (GCVE-0-2026-86193)

CVE-2026-64852 (GCVE-0-2026-64852)

CVE-2026-63408 (GCVE-0-2026-63408)

CVE-2026-63407 (GCVE-0-2026-63407)

CVE-2026-62668 (GCVE-0-2026-62668)

CVE-2026-62667 (GCVE-0-2026-62667)

CVE-2026-62666 (GCVE-0-2026-62666)

CVE-2026-61607 (GCVE-0-2026-61607)

CVE-2026-42843 (GCVE-0-2026-42843)

CVE-2026-86196 (GCVE-0-2026-86196)

CVE-2026-86195 (GCVE-0-2026-86195)

CVE-2026-86193 (GCVE-0-2026-86193)

CVE-2026-64852 (GCVE-0-2026-64852)

CVE-2026-63408 (GCVE-0-2026-63408)

CVE-2026-63407 (GCVE-0-2026-63407)

CVE-2026-62667 (GCVE-0-2026-62667)

CVE-2026-62666 (GCVE-0-2026-62666)

CVE-2026-62668 (GCVE-0-2026-62668)

CVE-2026-61607 (GCVE-0-2026-61607)

CVE-2026-42843 (GCVE-0-2026-42843)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.