Grav API Plugin CVE-2026-62387

Exploitation requires the attacker to already possess a valid API access token for the target Grav instance - obtained out-of-band via log leakage, Referer headers, browser history, or network capture - and requires the Grav API plugin to be installed at a version before 1.0.0-rc.16 with its default 'Access-Control-Allow-Origin: *' CORS configuration intact. The attack then executes when a browser loads attacker-controlled JavaScript (UI:P). Limiting factors: without a leaked token there is no impact, so any deployment that avoids token leakage or overrides the CORS header via a proxy is not exploitable; the flaw is specific to the header-based (not cookie-based) authentication model this plugin uses.

The CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N) reflects high confidentiality impact with lower integrity impact and no availability impact, consistent with an information-disclosure and limited-write CORS flaw rather than direct code execution. The most important caveat is that real-world exploitation is gated on the attacker first obtaining a valid access token - the description explicitly lists leakage vectors such as logs, Referer headers, browser history, or network capture - so the vendor's PR:N understates a meaningful precondition that this analysis treats as elevated attack complexity. No EPSS score, POC, or KEV entry was provided, so there is no evidence of active or automated exploitation; this is a real but conditional risk best characterized as targeted rather than opportunistic. The Information Disclosure and CORS Misconfiguration tags and the VulnCheck advisory corroborate the confidentiality-centric framing.

An attacker recovers a valid API access token from a leaked log file, a Referer header, or captured traffic, then hosts a malicious web page whose JavaScript issues fetch() calls to the target Grav API with that token in the Authorization or X-API-Token header. Because every response carries 'Access-Control-Allow-Origin: *', the attacker's browser-based script can read authenticated response bodies to exfiltrate sensitive content and issue write requests as the token's user. No public exploit is identified at time of analysis, and the CVSS UI:P indicates a page-load-level interaction rather than a complex lure.