Which versions of Grav API plugin are affected by CVE-2026-62386?

Grav CMS API plugin versions before 1.0.0-rc.16 exposes administrative authentication tokens in web server logs, browser caches, and proxy records through insecure query string handling.. A patch is available.

How to fix or mitigate CVE-2026-62386?

Within 24 hours, identify all Grav CMS instances running the API plugin and determine which are using versions before 1.0.0-rc.16. Within 7 days, implement compensating controls by disabling query string token parameters (?token=) in your web server configuration, enforcing Bearer token authentication only via HTTP Authorization headers, restricting API access by IP address, and auditing logs for evidence of token exposure or unauthorized API access. Within 30 days, monitor the getgrav/grav-plugin-api repository for release of patch version 1.0.0-rc.16 or later, upgrade immediately upon release, and rotate all JWT tokens and administrator API credentials.

Grav API plugin CVE-2026-62386

Q: What is the CVSS score of CVE-2026-62386?

CVE-2026-62386 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45086 HIGH

Use of GET Request Method With Sensitive Query Strings (CWE-598)

2026-07-17 VulnCheck

GHSA-cx27-6j8x-h4h6

Information Disclosure Grav Getgrav

8.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.4 HIGH

AC:H because a valid token must first leak into a log/Referer/proxy the attacker can read; PR:N since the captured token needs no prior privilege, and C:H/I:H reflect full admin read plus account/settings/page modification.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 00:51 vuln.today

CVE Published

Jul 17, 2026 - 00:07 cve.org

HIGH 8.2

DescriptionCVE.org

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.

AnalysisAI

Sensitive token exposure in the Grav CMS API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 allows attackers to hijack valid admin sessions after JWT access tokens leak from URLs. Because JwtAuthenticator::extractBearerToken accepts tokens via the ?token= query string on every API route, those tokens are written verbatim into web server access logs, Referer headers, browser history, and upstream proxy/CDN logs, and any captured token grants full admin API access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 score of 8.2 reflects the high value of the leaked admin credentials.

Technical ContextAI

Grav is a flat-file PHP CMS, and its optional API plugin exposes REST-style routes protected by JWT bearer authentication. The flaw is a CWE-598 (sensitive information transmitted in a query string) issue: rather than requiring the token only in the Authorization: Bearer HTTP header, the plugin's JwtAuthenticator::extractBearerToken method falls back to reading the credential from the ?token= URL query parameter. URL query strings are one of the most commonly logged and forwarded parts of an HTTP request, so a secret placed there propagates far beyond the intended TLS-protected request/response pair. The affected package per NVD CPE is cpe:2.3:a:getgrav:grav (the grav-plugin-api component), and only the plugin's token-handling path is at fault, not the JWT signing itself.

RemediationAI

Vendor-released patch: upgrade the Grav API plugin to 1.0.0-rc.16 or later, which removes the ?token= query-parameter fallback so tokens are only accepted in the Authorization header (see GHSA-4hpj-wmpw-ghwq). Until the plugin is updated, stop passing tokens in URLs and send them exclusively via the Authorization: Bearer header from all API clients; where you cannot update immediately, block or strip the token query parameter at a reverse proxy or WAF for API routes (trade-off: any tooling that relies on URL tokens will break), and configure web servers, proxies, and CDNs to omit query strings from access logs to limit further leakage (trade-off: reduced request-debugging visibility). Because previously used tokens may already sit in historical logs, browser history, and CDN caches, rotate and revoke all existing API access tokens after patching rather than assuming the upgrade alone contains the exposure.