CVE-2026-109320: fallo de gravedad media en getgrav grav-plugin-api
Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.2%
The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
getgrav · grav-plugin-apiCVEs relacionadas — getgrav grav-plugin-api
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-112779CRITICALGrav API Plugin before 1.0.42 Cache Exhaustion and Page Permission BypassEPSS 0.8%CVE-2026-62666HIGHGrav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of superEPSS 0.6%CVE-2026-63408HIGHGrav API Plugin: JWT Access Token Accepted via `?token=` URL Query ParameterEPSS 0.5%CVE-2026-72833HIGHGrav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API KeysEPSS 0.5%CVE-2026-72826HIGHGrav API Plugin before 1.0.13 Scope Bypass via createApiKeyEPSS 0.5%CVE-2026-62668CRITICALGrav API Plugin: Webhook SSRF via Unrestricted cURL ProtocolsEPSS 0.4%