EUVD-2026-62547Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects the prerequisite of attacker log-source access; confidentiality-only impact, no integrity or availability consequences.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.
Articles & Coverage 1
AnalysisAI
JWT bearer token leakage in the Grav API Plugin for Grav CMS (prior to 1.0.0-rc.16) exposes valid access tokens to any party with access to server logs, proxy logs, CDN logs, browser history, or Referer headers. The JwtAuthenticator::extractBearerToken() method accepted tokens supplied via the ?token= URL query parameter on every /api/v1 route - including state-changing endpoints - rather than restricting token-in-URL to the file-download routes where it is technically necessary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two conditions to align: (1) the Grav API Plugin version prior to 1.0.0-rc.16 must be installed and active, and (2) the attacker must have read access to at least one of the following secondary sources that capture full request URLs - Apache/web server access logs, reverse proxy or load-balancer logs, CDN access logs, browser history on a shared machine, or Referer headers transmitted to third-party resources embedded in pages returned by the API. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 High score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) captures the network-reachable nature and high confidentiality impact, but the PR:N metric deserves scrutiny: exploitation requires a legitimate token that was already issued to an authenticated user, so the attacker's effort is not zero - they must first obtain access to a log source. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Grav API Plugin to version 1.0.0-rc.16, which is the vendor-released patch addressing this issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Grav CMS instances running the API Plugin version prior to 1.0.0-rc.16 and immediately disable bearer token authentication via URL ?token= query parameters-require tokens exclusively in HTTP Authorization headers for all /api/v1 endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Grav Plugin Api
View allServer-Side Request Forgery in the Grav API plugin (grav-plugin-api) for Grav CMS before 1.0.6 lets a caller holding the
Privilege escalation in Grav API Plugin (all versions before 1.0.6) allows any authenticated user holding the api.users.
Permissive CORS misconfiguration in the Grav API Plugin (all versions prior to 1.0.0-rc.16) allows cross-origin JavaScri
Scope enforcement is entirely absent in the Grav API Plugin prior to 1.0.6, meaning any scoped API key silently exercise
Stored XSS in Grav CMS's grav-plugin-api (Admin2) allows a low-privileged editor to persist malicious JavaScript in page
Stored cross-site scripting in the Grav API Plugin (all versions prior to 1.0.2) allows an authenticated attacker holdin
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today