Executive brief
The Grav API plugin, used to provide programmatic access to the Grav content management system, contains a security flaw in how it handles authentication and cross-site requests. The plugin allows sensitive login tokens to be passed in web addresses (URLs) and tells web browsers to allow any website to read its data. This combination allows an attacker who finds a leaked token in server logs or browser history to take full control of the website, create new administrator accounts, and steal sensitive configuration or user data.
Technical details
The vulnerability arises from the intersection of two configurations in the Grav API plugin's JwtAuthenticator. First, the plugin accepts JWT tokens via the '?token=' URL query parameter (CWE-598), which causes tokens to leak into web server access logs, proxy logs, and Referrer headers. Second, the API responds with 'Access-Control-Allow-Origin: *' on all endpoints. While browsers typically block credentialed cross-origin requests when a wildcard is used, tokens in the URL are not treated as 'credentials' by the Fetch standard. This allows a malicious website to make authenticated requests to the API and read the responses. An attacker with a leaked token can perform state-changing operations, such as creating a super-admin user or exfiltrating system configuration. The issue is fixed in version 1.0.0-rc.16.
Affected products
- getgrav Grav API plugin < v1.0.0-rc.16
Timeline
- 2026-06-22: advisory: GitHub Security Advisory published by vendor
- 2026-07-08: disclosed: CVE published and NVD record created