Grav API Plugin CVE-2026-61452

Exploitation of the revocation bypass requires that the attacker first possess a valid, non-expired JWT access token issued by the Grav API plugin - this is a necessary prerequisite that must be satisfied through a separate compromise (token theft, credential compromise, SSRF, log exposure, etc.). The flaw itself has no special configuration prerequisite: any Grav installation with the API plugin enabled and any issued access token is affected by default. Exploitation is limited by the token's TTL (default 1 hour); once a token naturally expires it cannot be reused. Refresh tokens appear to be separately revocable, so an attacker who only possesses a refresh token (and not an access token) may not be able to persist access in the same way. The CVSS 4.0 vector PR:N reflects that no additional server-side privilege escalation is required beyond the stolen token.

The CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) is somewhat conservative: the vector correctly reflects network accessibility with no authentication or complexity barriers for exploiting the revocation gap itself, but VI:N may understate impact given the description states the attacker retains 'full API access,' which in most CMS API contexts includes write operations. No EPSS score was provided in the input data, limiting probabilistic exploit-likelihood assessment. The vulnerability is not listed in CISA KEV and no POC has been identified, which together suggest opportunistic mass exploitation is unlikely in the near term. The real-world risk is context-dependent: organizations that treat incident response steps (disabling accounts, forcing password resets) as sufficient containment will find those controls completely bypassed during the token's survival window. The 1-hour default TTL acts as a natural ceiling on the blast radius, but in high-sensitivity deployments this window may be unacceptably large. The primary risk is to environments where token theft is a realistic threat vector (e.g., exposed APIs, compromised CI/CD pipelines, SSRF vulnerabilities).

An attacker intercepts or exfiltrates a valid JWT access token through a secondary vulnerability (e.g., logs exposed to an S3 bucket, SSRF, or a compromised CI/CD secret store). When the victim or administrator detects the compromise and disables the account or changes the password, the attacker's stolen token continues to grant full Grav API access - reading content, potentially writing or deleting pages - for up to the default 1-hour token lifetime with no server-side mechanism to stop it. No public POC has been identified, but exploitation requires only a standard HTTP client and the stolen token.