Grav API Plugin CVE-2026-109320

Exploitation requires a pre-existing, still-valid authenticated session: the actor must have logged in and obtained an authorized browser session or a remember-me token from the Grav API plugin BEFORE their account was disabled, and that session/token must not yet have expired. The flaw is triggered specifically when an operator disables or revokes a user account while SessionAuthenticator fails to re-validate account state on subsequent API calls. Limiting factors that reduce realistic risk: the attacker must already be (or have been) a legitimately authenticated user with API access (PR:L), the window is bounded by normal session/remember-me expiry, and only Grav installations running grav-plugin-api before 1.0.36 that actually use account disablement as a revocation control are affected. There is no path for a wholly unauthenticated outsider.

This is a genuine but moderate-severity access-control weakness, not a high-urgency emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) and the 5.3 base score are internally consistent with the description: exploitation is over the network, low complexity, requires privileges (PR:L - the actor must already possess a valid, previously-authorized session), needs no user interaction, and yields only low confidentiality and low integrity impact with no availability impact. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input. Per precision rules this means 'no public exploit identified at time of analysis.' The signals do not conflict - a low-privilege, low-impact session-lifecycle flaw with no exploitation evidence points to a low-to-moderate real-world priority rather than a critical issue. The practical risk is narrow: it only matters to operators who rely on disabling/revoking accounts as a security control, where a disabled user can continue acting until their existing session or remember-me token naturally expires. There is a minor nuance worth noting - the tag 'Information Disclosure' understates the issue, since the CVSS vector assigns both VC:L and VI:L, implying the retained API access permits low-impact writes/actions, not merely reading data.

An employee or API consumer whose account an operator has just disabled (e.g. after termination or compromise) continues to hold an active browser session or a remember-me cookie. Because SessionAuthenticator never re-checks account state, that user keeps calling authenticated Grav API endpoints - reading and performing low-impact actions - until the session or token expires naturally. No public exploit code is referenced; exploitation requires only replaying the already-authorized session.