EUVD-2026-44648
GHSA-r9r9-wg76-6qmq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Grav site running vulnerable API plugin
-
DeliveryPOST forgot-password with attacker host in admin_base_url
-
ExploitServer emails poisoned reset link to victim
-
ExecutionVictim clicks link, token sent to attacker
-
PersistAttacker replays valid token on real site
-
ImpactReset password and take over account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Redirect URL validation
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to be running the grav-plugin-api (Grav API plugin) below 1.0.4 with the /api/v1/auth/forgot-password endpoint reachable, and requires the victim to click the attacker-poisoned reset link delivered by email - the CVSS UI:P/UI:R user-interaction requirement is the primary limiting factor. The attacker needs no authentication (PR:N) and controls the reset host via the admin_base_url JSON field or the Referer/Origin headers, so no special server-side configuration is needed beyond the plugin being installed and the account-recovery flow being enabled. Realistic risk is bounded by the need to induce or coincide with a password-reset action for a valid account and to get the victim to follow the malicious link; it does not grant takeover without that user interaction. |
| Impact | This is a genuine high-priority issue rather than a CVSS-inflated one, but its exploitation is gated by user interaction. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, with subsequent-system SC:H/SI:H/SA:H) scores 9.4 and reflects unauthenticated, network-reachable exploitation with high confidentiality and integrity impact. The critical limiting factor is UI:P - the victim must actually click the poisoned link in the reset email - so exploitation depends on social-engineering success and on the target having initiated or being tricked into a password reset. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no POC was referenced, so there is no evidence of active or widespread exploitation; the risk is currently theoretical-but-credible. The elevated subsequent-system impact metrics (SC/SI/SA:H) set by the vendor are debatable for what is functionally a single-account takeover and should be verified against the actual deployment's privilege model. |
| Exploit ScenarioDerived | An attacker sends an unauthenticated POST to /api/v1/auth/forgot-password for a target admin's email with admin_base_url set to https://evil.attacker.example (or spoofs the Origin/Referer header), causing Grav to email the victim a reset link pointing at the attacker's server. When the victim clicks the link, their browser hands the valid reset token to the attacker, who replays it against the legitimate site to set a new password and take over the account. No public POC is referenced, and success requires the victim to follow the poisoned link (UI:P). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Password reset token poisoning in the Grav API plugin (grav-plugin-api) before 1.0.4 lets an unauthenticated attacker hijack the account recovery flow by supplying an attacker-controlled host in the admin_base_url field (or Referer/Origin headers) of the POST /api/v1/auth/forgot-password request. Because the reset email's link is built from this unvalidated host, a victim who clicks it leaks a valid, unexpired reset token to the attacker, yielding full account takeover. No public exploit is identified at time of analysis, and it is not in CISA KEV, but VulnCheck's advisory and vendor GHSA-5xc4-j99p-cp4m confirm the flaw and a 1.0.4 fix.
RemediationAI
Upgrade the Grav API plugin to version 1.0.4 or later, which is the vendor-released patch that addresses the origin-validation flaw (see GHSA-5xc4-j99p-cp4m). If immediate patching is not possible, apply compensating controls to the /api/v1/auth/forgot-password endpoint: reject or ignore the client-supplied admin_base_url field and force the reset link's base URL to a server-side configured canonical origin; strip or do not trust the Referer and Origin headers when building the reset URL; and restrict the reset link host to an allowlist of the server's own domain(s). At the network edge, a WAF rule can drop forgot-password requests whose admin_base_url or Origin/Referer host differs from the site's known hostname - note this may cause false positives for legitimate multi-domain deployments. Do not rely on disabling the endpoint entirely unless password reset is handled elsewhere, as that removes account-recovery functionality. Full advisory context is at https://www.vulncheck.com/advisories/grav-before-password-reset-token-poisoning-via-admin-base-url.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Grav is a PHP-based flat-file CMS; the affected component is its optional REST API plugin (grav-plugin-api), which exposes authentication endpoints including forgot-password. The root cause is CWE-601 (URL Redirection to Untrusted Site / Open Redirect) applied to email link generation: the sanitizeHttpUrl() helper validates only that the client-supplied admin_base_url uses an http/https scheme and never checks the host against the server's own origin. Consequently the base URL used to construct the password-reset link is fully attacker-influenced, either via the JSON body field or the Referer/Origin request headers. This turns a classic open-redirect weakness into a token-disclosure primitive, since the sensitive reset token is appended to a host the attacker controls.
Know when Grav gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Unauthenticated network request (AV:N/PR:N) but the victim must click the poisoned reset link (UI:R); token disclosure plus account takeover give C:H/I:H, with no direct availability impact (A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks that the URL scheme is http/https and never verifies the host against the server's own origin, so an attacker can supply an arbitrary host. As a result, an unauthenticated attacker can cause the password reset email sent to a victim to contain a reset link pointing at an attacker-controlled server; when the victim follows the link, the valid reset token is disclosed to the attacker, enabling full account takeover. The vulnerable base URL can also be influenced via the Referer or Origin headers.
Executive ViewAI
Grav API plugin versions before 1.0.4 allow unauthenticated attackers to perform complete account takeover by hijacking the password reset flow through token poisoning. An attacker can intercept reset emails containing valid recovery tokens, gaining full access to any user account without requiring existing credentials or authentication.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Server-side template injection (SSTI) in Grav (getgrav/grav) prior to 1.8.0-beta.27 allows an authenticated attacker hol
Broken access control in Grav CMS (CWE-285) before 1.8.0-beta.27 lets an authenticated editor-level user escalate their
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to wri
Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users perm
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past
Server-side request forgery (SSRF) in Grav CMS versions prior to 1.7.49.5 allows remote authenticated attackers to make
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary
Exploit-DB