Is there a patch available for CVE-2026-61452?

Yes, a patch is available for CVE-2026-61452. Update the affected software to the latest version immediately.

Grav API Plugin CVE-2026-61452

Q: What is the CVSS score of CVE-2026-61452?

CVE-2026-61452 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-44649 MEDIUM

Insufficient Session Expiration (CWE-613)

2026-07-15 VulnCheck

GHSA-rrr3-rpgw-867x

Information Disclosure Grav Getgrav

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

AC:H reflects mandatory token-theft precondition; I:L added because 'full API access' implies write capability beyond VC:L confidentiality.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 13:03 EUVD

Analysis Generated

Jul 15, 2026 - 12:35 vuln.today

DescriptionCVE.org

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.

AnalysisAI

Insufficient session invalidation in the Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 renders stolen JWT access tokens permanently valid for up to one hour post-compromise. Because tokens are issued without a jti (JWT ID) claim, the server retains no mechanism to selectively revoke them - meaning logout events, password resets, new token issuance, and even account disablement are all ineffective at terminating an active attacker's session. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 vector (AV:N/AC:L/PR:N) reflects that any attacker already in possession of a token can trivially exploit this revocation gap over the network.

Technical ContextAI

CWE-613 (Insufficient Session Expiration) describes this root cause precisely: the application does not ensure that session tokens become invalid after a security event. JWT access tokens issued by the plugin lack the jti (JWT ID) claim, which is the standard mechanism for maintaining a server-side token denylist. Without jti, the server cannot distinguish between a legitimately active token and one that should have been revoked - all valid, non-expired tokens with a correct signature are accepted unconditionally. Refresh tokens appear to be handled separately (implying some revocation capability exists for them), but access tokens with the default 1-hour TTL are entirely stateless and unrevocable. The affected component is identified by CPE cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* and the plugin is the REST API surface for the Grav flat-file CMS.

RemediationAI

The primary fix is to upgrade the Grav API plugin to version 2.0.4 or later, which resolves the missing jti claim and restores server-side token revocation capability; see the vendor advisory at https://github.com/getgrav/grav/security/advisories/GHSA-m8g9-wxhx-6f86 for upgrade guidance. If immediate patching is not possible, the most effective compensating control is to reduce the JWT access token TTL to the shortest operationally viable value (e.g., 5-10 minutes) via the plugin configuration, which limits the revocation-bypass window; this does not fix the flaw but materially shrinks the attacker's dwell time. Operators should additionally restrict the API endpoint to trusted network ranges or IP allowlists at the web server or firewall level to reduce token exfiltration opportunities. Note that account disablement and password resets are NOT effective mitigations for already-issued tokens until the patch is applied.