Advisories · Technology

getgrav grav-plugin-api.

Every CVE that names getgrav grav-plugin-api among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-112779 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
- getgrav grav-plugin-api
- Denial of service
Not analysed yet 19 Oct 2026
CVE-2026-109320 CVE record

CVSS 5.3 Medium

Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
- getgrav grav-plugin-api
- Authentication bypass
Not analysed yet 12 Oct 2026
CVE-2026-109317 CVE record

CVSS 8.6 High

Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
- getgrav grav-plugin-api
- Privilege escalation
Not analysed yet 12 Oct 2026
CVE-2026-86196 CVE record

CVSS 8.7 High

Grav API Plugin before 1.0.20 Authentication Bypass via Host Header
- getgrav grav-plugin-api
- Authentication bypass
Not analysed yet 5 Sept 2026
CVE-2026-86195 CVE record

CVSS 8.7 High

grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag
- getgrav grav-plugin-api
- Privilege escalation
Not analysed yet 5 Sept 2026
CVE-2026-86193 CVE record

CVSS 8.7 High

Grav API Plugin Authentication Bypass via Group-Inherited Super
- getgrav grav-plugin-api
- Broken access control
Not analysed yet 5 Sept 2026
CVE-2026-64852 CVE record

CVSS 8.7 High

Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account
- getgrav grav-plugin-api
- Broken access control
Not analysed yet 19 Aug 2026
CVE-2026-63408 CVE record

CVSS 7.5 High

Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter
- getgrav grav-plugin-api
- CWE-598
Not analysed yet 19 Aug 2026
CVE-2026-63407 CVE record

CVSS 8.2 High

Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses
- getgrav grav-plugin-api
- CWE-942
Not analysed yet 19 Aug 2026
CVE-2026-62667 CVE record

CVSS 8.1 High

Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL
- getgrav grav-plugin-api
- Broken access control
Not analysed yet 19 Aug 2026
CVE-2026-62666 CVE record

CVSS 8.8 High

Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super
- getgrav grav-plugin-api
- Broken access control
Not analysed yet 19 Aug 2026
CVE-2026-62668 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols
- grav
- getgrav grav-plugin-api
- Server-side request forgery (SSRF)
Not analysed yet 19 Aug 2026
CVE-2026-61607 CVE record

CVSS 4.6 Medium

Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer
- getgrav grav-plugin-api
- Cross-site scripting (XSS)
Not analysed yet 19 Aug 2026
CVE-2026-72833 CVE record

CVSS 8.7 High

Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys
- getgrav grav-plugin-api
- Privilege escalation
Not analysed yet 14 Aug 2026
CVE-2026-72826 CVE record

CVSS 8.7 High

Grav API Plugin before 1.0.13 Scope Bypass via createApiKey
- getgrav grav-plugin-api
- Privilege escalation
Not analysed yet 14 Aug 2026
CVE-2026-72825 CVE record

CVSS 7.2 High

Grav API Plugin before 1.0.13 API-key scope cap bypass via ReportsController
- getgrav grav-plugin-api
- Broken access control
Not analysed yet 14 Aug 2026
CVE-2026-61451 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Grav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_url
- getgrav grav-plugin-api
- Open redirect
Not analysed yet 15 Jul 2026