CVE-2026-62387
HIGH
CVSS 7.1
grav
Verified Advisory
Overly permissive CORS in Grav API plugin (CVE-2026-62387)
The Grav API plugin (getgrav/grav-plugin-api) shipped Access-Control-Allow-Origin: * as its default CORS configuration on all API responses, including authenticated endpoints and OPTIONS preflight responses. An attacker who obtains a valid JWT or API token can issue fully authenticated cross-origin requests from any malicious website, enabling unauthorized reading of sensitive data and write operations as the token's user.
Affected versions:
- <= v1.0.0-rc.15
We recommend updating to: 1.0.0-rc.16.
CVSS 7.1 · our assessment: this_week
Vendor advisory: https://github.com/getgrav/grav/security/advisories/GHSA-93px-98wh-6fj2
Details: https://vuln.today/cve/CVE-2026-62387
Verified by vuln.today against published advisories.
Affected versions
- – <= v1.0.0-rc.15
Fixed in: 1.0.0-rc.16
More advisories for grav
- CVE-2026-65608 – Remote code execution in Grav CMS via unchecked callable in FlexDirectory (CVE-2026-65608)
- CVE-2026-65895 – Broken access control in Grav API Plugin configuration scopes (CVE-2026-65895)
- CVE-2026-65896 – Path traversal in Grav API Plugin POST /pages/{route}/move endpoint (CVE-2026-65896)
- CVE-2026-65897 – Privilege escalation via unvalidated groups field in Grav API Plugin (CVE-2026-65897)
- CVE-2026-65603 – Privilege Escalation via profile self-update in Grav Login plugin (CVE-2026-65603)
- CVE-2026-65008 – Remote code execution via unrestricted callable in Grav CMS (CVE-2026-65008)
- CVE-2026-65007 – Missing authorization on API key generation in Grav API plugin (CVE-2026-65007)
- CVE-2026-62230 – Case-sensitive extension filtering bypass in Grav CMS (CVE-2026-62230)