How to fix or mitigate CVE-2026-58656?

Within 24 hours: identify all Grav installations with the API plugin active and document current version numbers. Within 7 days: develop and test patch deployment plan for v1.0.0-rc.16 in a non-production environment. Within 30 days: apply vendor patch (v1.0.0-rc.16) to all production Grav instances and verify successful deployment.

CVE-2026-58656

Q: What is the CVSS score of CVE-2026-58656?

CVE-2026-58656 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42266 HIGH

Use of GET Request Method With Sensitive Query Strings (CWE-598)

2026-07-08 disclosure@vulncheck.com

GHSA-fx5h-wv8r-5j9q

Information Disclosure

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 14:52 vuln.today

DescriptionCVE.org

Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token from access logs, proxy logs, browser history, or Referrer headers can create persistent backdoor super-admin accounts and exfiltrate sensitive configuration and user data.

AnalysisAI

Cross-origin admin account takeover in the Grav CMS API plugin before v1.0.0-rc.16 stems from two combined weaknesses: JWT tokens are accepted through the ?token= URL query parameter and every API response returns the wildcard Access-Control-Allow-Origin: * header. Any attacker who harvests a leaked JWT from access logs, proxy logs, browser history, or Referrer headers can replay it in fully authenticated cross-origin requests from an arbitrary malicious site, then create persistent super-admin accounts and exfiltrate configuration and user data. …