EUVD-2026-62545Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
AV:N for web-based attack; PR:N as attacker needs no account on the instance; UI:R because victim must visit attacker page; S:C for browser SOP scope change; I:L for write operations bounded by victim token's privileges.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticated /api/v1 endpoints. JavaScript from any origin can submit an attacker-obtained JWT through the Authorization or X-API-Token header, read the authenticated response, and perform write operations with the token owner's privileges, enabling data exfiltration and account modification. This issue is fixed in version 1.0.0-rc.16.
AnalysisAI
Permissive CORS misconfiguration in the Grav API Plugin (all versions prior to 1.0.0-rc.16) allows cross-origin JavaScript on any attacker-controlled website to submit a stolen JWT via Authorization or X-API-Token headers and read full authenticated API responses, enabling data exfiltration and account modification with the token owner's privileges. The wildcard Access-Control-Allow-Origin: * header was returned by default for all /api/v1 endpoints - including authenticated ones - bypassing browser Same-Origin Policy protections entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must separately possess a valid, non-expired JWT for the target Grav API Plugin instance - for example, by harvesting it from server access logs or HTTP Referer headers where it was leaked via the ?token= URL query parameter accepted on all API routes prior to the patch. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.2 score is driven by C:H (full read of authenticated API data), S:C (browser SOP bypass changes scope beyond the vulnerable component), and AV:N/AC:L, all of which are well-justified by the vulnerability class. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Grav API Plugin to version 1.0.0-rc.16, available at https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.0-rc.16 (fix commit 56ae2ca3bf36c8299a4b3d376c6a20e8c0ed5ba9). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Grav API Plugin deployments and identify instances running versions prior to 1.0.0-rc.16, prioritizing systems handling sensitive or customer data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cors Misconfiguration
View allCasdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validati
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to
Permissive CORS policy in ericc-ch copilot-api up to version 0.7.0 allows remote attackers to access the Token Endpoint
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today