Getgrav Grav-plugin-api vulnerabilities

• getgrav grav-plugin-api Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass CVE-2026-112779 9.3 CriticalOctober 19, 2026
• getgrav grav-plugin-api Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass CVE-2026-109320 5.3 MediumOctober 12, 2026
• getgrav grav-plugin-api Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants CVE-2026-109317 8.6 HighOctober 12, 2026
• getgrav grav-plugin-api Grav API Plugin before 1.0.20 Authentication Bypass via Host Header CVE-2026-86196 8.7 HighSeptember 5, 2026
• getgrav grav-plugin-api grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag CVE-2026-86195 8.7 HighSeptember 5, 2026
• getgrav grav-plugin-api Grav API Plugin Authentication Bypass via Group-Inherited Super CVE-2026-86193 8.7 HighSeptember 5, 2026
• getgrav grav-plugin-api Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys CVE-2026-72833 8.7 HighAugust 14, 2026
• getgrav grav-plugin-api Grav API Plugin before 1.0.13 Scope Bypass via createApiKey CVE-2026-72826 8.7 HighAugust 14, 2026
• getgrav grav-plugin-api Grav API Plugin before 1.0.13 API-key scope cap bypass via ReportsController CVE-2026-72825 7.2 HighAugust 14, 2026
• getgrav grav-plugin-api Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account CVE-2026-64852 8.7 HighJuly 21, 2026
• getgrav grav-plugin-api Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses CVE-2026-63407 8.2 HighJuly 17, 2026
• getgrav grav-plugin-api Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter CVE-2026-63408 7.5 HighJuly 17, 2026
• getgrav grav, grav-plugin-api +1 more Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols CVE-2026-62668 9.4 CriticalJuly 17, 2026
• getgrav grav-plugin-api Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super CVE-2026-62666 8.8 HighJuly 17, 2026
• getgrav grav-plugin-api Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL CVE-2026-62667 8.1 HighJuly 17, 2026
• getgrav grav-plugin-api Grav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_url CVE-2026-61451 9.4 CriticalJuly 15, 2026
• getgrav grav-plugin-api Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer CVE-2026-61607 4.6 MediumJuly 10, 2026
• getgrav grav-plugin-api Stored XSS via missing XSS safety check in Admin2 Pages API partial validation CVE-2026-11982 5.1 MediumJune 18, 2026
• getgrav grav-plugin-api grav-plugin-api: Grav API Privilege Escalation to Super Admin CVE-2026-42843 Fix available 8.8 HighMay 5, 2026