Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

grav-plugin-api — Vulnerabilities & Security Advisories 8

All 8 CVE vulnerabilities found in grav-plugin-api, with AI-generated Chinese analysis, references, and POCs.

Vendor: getgrav

CVE IDTitleCVSSSeverityPublished
CVE-2026-64852 Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account CWE-862 8.7 High2026-08-19
CVE-2026-63408 Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter CWE-598 7.5 High2026-08-19
CVE-2026-63407 Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses CWE-942 8.2 High2026-08-19
CVE-2026-62667 Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL CWE-862 8.1 High2026-08-19
CVE-2026-62666 Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super CWE-639 8.8 High2026-08-19
CVE-2026-61607 Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer CWE-79 4.6 Medium2026-08-19
CVE-2026-11982 Stored XSS via missing XSS safety check in Admin2 Pages API partial validation CWE-79--2026-06-18
CVE-2026-42843 grav-plugin-api: Grav API Privilege Escalation to Super Admin CWE-863 8.8 High2026-05-11

All 8 known CVE vulnerabilities affecting grav-plugin-api with full Chinese analysis, references, and POCs where available.