Grav API Plugin CVE-2026-86196

The Grav API plugin must be installed and the forgot-password endpoint must be reachable over the network; no authentication is required by the attacker. The victim must have a valid email address registered on the platform and must click the malicious reset link delivered to their inbox - passive user interaction (UI:P in CVSS 4.0) is the primary limiting factor. The attack requires that the attacker's Host header value is actually used to construct the email link, which holds in versions prior to 1.0.20. The attacker does not need prior knowledge of the reset token; they simply need network access to the endpoint and control over a domain to which they can direct traffic. No special non-default configuration is required beyond having the plugin installed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) accurately captures most of the risk profile: the attack is trivially automatable from the network with no required privileges, and the only friction is passive victim interaction - the target must click a link in an email, a realistic social engineering outcome especially given that the email is legitimately from the platform. The score of 8.7 is appropriate; even a mid-sized municipal IT team in sanok operating a Grav-based intranet or portal should treat this as urgent given that super-admin accounts are in scope. The provided VA:H (availability high) in the CVSS 4.0 vector appears slightly overstated as a direct consequence - the vulnerability mechanism itself does not destroy data or crash services, though a super-admin takeover could secondarily enable destructive actions. EPSS data was not provided in the input; given the simplicity of the technique and the breadth of affected accounts, exploitation probability is likely non-negligible. No KEV listing and no public POC have been identified, suggesting exploitation has not yet been confirmed at scale.

An attacker identifies a Grav site running the API plugin and submits a POST request to the forgot-password endpoint for a known or guessed account email, setting the HTTP Host header to a domain they control (e.g., attacker.example.com). The plugin generates a reset link like https://attacker.example.com/reset?token=<TOKEN> and emails it to the legitimate account owner. If the victim clicks the link - believing it is from their own site - the attacker's server captures the reset token, which can then be used to set a new password and take over the account, including super-admin accounts.