What’s Vulnerable › Products

getgrav grav-plugin-api vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your getgrav grav-plugin-api version is affected

Latest getgrav grav-plugin-api vulnerabilities

• CVE-2026-112779 — Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass (CVSS 9.8)
• CVE-2026-109320 — Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass (CVSS 5.4)
• CVE-2026-109317 — Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants (CVSS 7.2)
• CVE-2026-86196 — Grav API Plugin before 1.0.20 Authentication Bypass via Host Header (CVSS 8.7)
• CVE-2026-86195 — grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag (CVSS 8.7)
• CVE-2026-86193 — Grav API Plugin Authentication Bypass via Group-Inherited Super (CVSS 8.7)
• CVE-2026-64852 — Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account (CVSS 8.7)
• CVE-2026-63408 — Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter (CVSS 7.5)
• CVE-2026-63407 — Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses (CVSS 8.2)
• CVE-2026-62668 — Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols (CVSS 9.4)
• CVE-2026-62667 — Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL (CVSS 8.1)
• CVE-2026-62666 — Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super (CVSS 8.8)
• CVE-2026-61607 — Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer (CVSS 4.6)
• CVE-2026-72833 — Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys (CVSS 8.8)
• CVE-2026-42843 — grav-plugin-api: Grav API Privilege Escalation to Super Admin (CVSS 8.8)