CVE-2026-62387
HIGH
CVSS 7.1
grav
Verified Advisory
Overly permissive CORS in Grav API plugin (CVE-2026-62387)
The Grav API plugin (getgrav/grav-plugin-api) shipped Access-Control-Allow-Origin: * as its default CORS configuration on all API responses, including authenticated endpoints and OPTIONS preflight responses. An attacker who obtains a valid JWT or API token can issue fully authenticated cross-origin requests from any malicious website, enabling unauthorized reading of sensitive data and write operations as the token's user.
Affected versions:
- <= v1.0.0-rc.15
We recommend updating to: 1.0.0-rc.16.
CVSS 7.1 · our assessment: this_week
Vendor advisory: https://github.com/getgrav/grav/security/advisories/GHSA-93px-98wh-6fj2
Details: https://vuln.today/cve/CVE-2026-62387
Verified by vuln.today against published advisories.
Affected versions
- – <= v1.0.0-rc.15
Fixed in: 1.0.0-rc.16
More advisories for grav
- CVE-2026-62230 – Case-sensitive extension filtering bypass in Grav CMS (CVE-2026-62230)
- CVE-2026-62231 – Authorization bypass in Grav API plugin (CVE-2026-62231)
- CVE-2026-62232 – Two-factor authentication bypass in Grav CMS (CVE-2026-62232)
- CVE-2026-62233 – Privilege escalation in Grav Plugin API (CVE-2026-62233)
- CVE-2026-62234 – Server-Side Request Forgery in Grav CMS (CVE-2026-62234)
- CVE-2026-62386 – JWT token exposure in URL parameters in Grav API plugin (CVE-2026-62386)