Which versions of Grav API Plugin are affected by CVE-2026-65895?

The Grav API Plugin (versions before 1.0.10) contains a high-severity access control vulnerability (CVE-2026-65895, CVSS 8.2) with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-65895?

Within 24 hours: immediately audit all users holding api.config.write privilege in Grav API Plugin, revoke this privilege from all but essential administrators, and disable the plugin entirely if not actively required for operations. Within 7 days: implement rate limiting at the web server or Web Application Firewall level as a failsafe control, enable detailed logging of all API authentication attempts and configuration changes, and configure alerts for suspicious brute-force patterns and CORS policy modifications. Within 30 days: contact the Grav project for security guidance and patches for version 1.0.10 or later, complete security testing of any patched versions, and plan a controlled upgrade of the plugin.

Grav API Plugin CVE-2026-65895

Q: What is the CVSS score of CVE-2026-65895?

CVE-2026-65895 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-48245 HIGH

Missing Authorization (CWE-862)

2026-07-23 disclosure@vulncheck.com

GHSA-cvg5-68p3-p7qp

Authentication Bypass

8.2

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 23, 2026 - 14:04 EUVD

Analysis Generated

Jul 23, 2026 - 12:49 vuln.today

CVE Published

Jul 23, 2026 - 12:18 cve.org

HIGH 8.2

DescriptionCVE.org

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled.

AnalysisAI

Broken access control in the Grav API Plugin before 1.0.10 lets authenticated users holding the api.config.write privilege modify security-critical configuration scopes they should not control, specifically site-wide rate limiting and CORS policy. An attacker can switch off rate limiting to enable unthrottled credential brute-forcing and add attacker-controlled origins to CORS with credentials enabled, weakening the site's authentication and cross-origin defenses. No public exploit identified at time of analysis; the issue is rated CVSS 4.0 8.2 (High) and classified as CWE-862 Missing Authorization.