Which versions of Grav API Plugin are affected by CVE-2026-62387?

The Grav API plugin contains a high-severity cross-origin vulnerability (CVE-2026-62387, CVSS 7.1) that allows attackers with a valid API token to bypass browser-based access controls and read or…. A patch is available.

How to fix or mitigate CVE-2026-62387?

Within 24 hours: Identify all Grav installations running the API plugin before version 1.0.0-rc.16, immediately disable the API plugin if it is not actively required, and rotate all existing API tokens and keys. Within 7 days: Deploy a Web Application Firewall (WAF) rule blocking requests with suspicious Origin headers targeting API endpoints, implement request logging to identify any suspicious cross-origin API calls, and review API token usage for unauthorized access patterns. Within 30 days: Monitor for and deploy Grav API plugin version 1.0.0-rc.16 when the vendor releases the patch, implement explicit allowed-origins configuration in place of the wildcard CORS header, and establish a token rotation schedule to prevent token leakage from creating persistent risk.

Grav API Plugin CVE-2026-62387

Q: What is the CVSS score of CVE-2026-62387?

CVE-2026-62387 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45087 HIGH

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-07-17 VulnCheck

GHSA-h4x5-fmw9-97f9

Information Disclosure Cors Misconfiguration Grav Getgrav

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Requires a separately leaked valid token (AC:H) and a browser loading attacker script (UI:R); wildcard CORS yields high-confidentiality read and limited write (I:L), no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 00:51 vuln.today

CVE Published

Jul 17, 2026 - 00:07 cve.org

HIGH 7.1

DescriptionCVE.org

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default CORS configuration on all responses, including authenticated endpoints and preflight (OPTIONS) responses. Because the plugin accepts credentials via the Authorization and X-API-Token headers (set programmatically by JavaScript rather than via cookies), an attacker who obtains a valid access token (e.g., via log leakage, Referer headers, browser history, or network capture) can issue fully authenticated cross-origin requests from any malicious website to read sensitive data and perform write operations as the token's user. Fixed in 1.0.0-rc.16.

AnalysisAI

Cross-origin data exposure in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 stems from a hardcoded 'Access-Control-Allow-Origin: *' header returned on every response, including authenticated endpoints and preflight (OPTIONS) responses. Because the plugin authenticates via the Authorization and X-API-Token request headers rather than cookies, any malicious website scripting a leaked access token can read the response bodies of authenticated endpoints and perform write actions as that token's user. Reported by VulnCheck with no public exploit identified at time of analysis; not listed in CISA KEV.

Technical ContextAI

Grav is a flat-file, database-free PHP CMS, and the API plugin exposes REST-style endpoints for programmatic content and administrative operations. The root cause is CWE-942 (Permissive Cross-domain Policy with Untrusted Domains): the plugin statically emits a wildcard CORS policy instead of validating against an allowlist of trusted origins. Normally a wildcard ACAO blocks cookie-based credentialed requests, but this plugin carries credentials in the custom Authorization and X-API-Token headers that JavaScript sets explicitly, so the wildcard policy directly permits arbitrary origins to both send those headers and read the returned responses. The affected CPE is cpe:2.3:a:getgrav:grav (the API plugin component) across all versions prior to the fix.

RemediationAI

Vendor-released patch: upgrade the Grav API plugin to 1.0.0-rc.16 or later, which removes the default wildcard CORS policy; this is the primary and recommended fix, per advisory GHSA-93px-98wh-6fj2. If immediate upgrade is not possible, place the API behind a reverse proxy (nginx/Apache) that strips or overrides the plugin's 'Access-Control-Allow-Origin: *' header and reflects only an explicit allowlist of trusted origins, with the trade-off that legitimate cross-origin browser clients must then be enumerated and whitelisted. Additionally restrict network access to the API endpoints to trusted hosts or VPN, and rotate any access tokens that may have been exposed while tightening token handling to reduce leakage via logs and Referer headers, accepting that these controls reduce but do not eliminate exposure until the plugin is patched.