# Grav API Plugin vulnerabilities Source: https://junglewise.ai/threats/technologies/api-plugin Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/api-plugin.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 24 vulnerabilities in Grav API Plugin: 0 in the last 7 days and 13 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-112779, was published on 19 October 2026. 2 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 13 - All time: 24 (4 critical, 0 exploited in the wild) ## About Grav API Plugin A plugin for the Grav CMS that provides a RESTful API to interact with the site's content and configuration. ## Latest Grav API Plugin vulnerabilities - [CVE-2026-112779: Grav API plugin cache exhaustion and authorization bypass](https://junglewise.ai/threats/cve-2026-112779-grav-api-plugin-grav-plugin-api-1-0-40-before-1-0-42-caches-a) (critical, CVSS 9.8, published 19 Oct 2026) - [CVE-2026-109320: Grav API plugin session validation bypass in disabled accounts](https://junglewise.ai/threats/cve-2026-109320-the-grav-api-plugin-grav-plugin-api-before-1-0-36-contains-an) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2026-86196: Grav API Plugin password reset link spoofing via Host header](https://junglewise.ai/threats/cve-2026-86196-grav-api-plugin-password-reset-link-spoofing-via-host-header) (info, CVSS 8.7, published 5 Sep 2026) - [CVE-2026-86193: Grav API Plugin authorization bypass in user-management guards](https://junglewise.ai/threats/cve-2026-86193-grav-api-plugin-authorization-bypass-in-user-management-guards) (info, CVSS 8.7, published 5 Sep 2026) - [CVE-2026-80204: Grav API Plugin scope cap bypass in page permissions](https://junglewise.ai/threats/cve-2026-80204-grav-api-plugin-scope-cap-bypass-in-page-permissions) (medium, CVSS 5.4, published 26 Aug 2026) - [CVE-2026-80203: Grav API Plugin authorization bypass in user management](https://junglewise.ai/threats/cve-2026-80203-grav-api-plugin-authorization-bypass-in-user-management) (critical, CVSS 9.8, published 26 Aug 2026) - [CVE-2026-56708: Grav API plugin server-side request forgery in webhook delivery](https://junglewise.ai/threats/cve-2026-56708-grav-api-plugin-server-side-request-forgery-in-webhook-delivery) (medium, CVSS 5.3, published 25 Aug 2026) - [CVE-2026-64852: Grav API Plugin privilege escalation in API key management](https://junglewise.ai/threats/cve-2026-64852-grav-api-plugin-privilege-escalation-in-api-key-management) (info, CVSS 8.8, published 19 Aug 2026) - [CVE-2026-63408: Grav API Plugin JWT token exposure in URL query parameter](https://junglewise.ai/threats/cve-2026-63408-grav-api-plugin-jwt-token-exposure-in-url-query-parameter) (high, CVSS 7.5, published 19 Aug 2026) - [CVE-2026-62668: Grav API Plugin server-side request forgery via webhook validation bypass](https://junglewise.ai/threats/cve-2026-62668-grav-api-plugin-server-side-request-forgery-via-webhook) (info, CVSS 6.5, published 19 Aug 2026) - [CVE-2026-62667: Grav API Plugin API key scope bypass](https://junglewise.ai/threats/cve-2026-62667-grav-api-plugin-api-key-scope-bypass) (high, CVSS 8.1, published 19 Aug 2026) - [CVE-2026-75833: Grav API plugin open redirect via backslash bypass](https://junglewise.ai/threats/cve-2026-75833-grav-api-plugin-open-redirect-via-backslash-bypass) (medium, CVSS 4.2, published 18 Aug 2026) - [CVE-2026-75832: Grav API plugin authorization bypass in BlueprintPathResolver](https://junglewise.ai/threats/cve-2026-75832-grav-api-plugin-authorization-bypass-in-blueprintpathresolver) (medium, CVSS 4.3, published 18 Aug 2026) - [CVE-2026-65897: Grav API Plugin privilege escalation in InvitationsController](https://junglewise.ai/threats/cve-2026-65897-grav-api-plugin-privilege-escalation-in-invitationscontroller) (high, CVSS 8.8, published 23 Jul 2026) - [CVE-2026-65896: getgrav Grav API Plugin path traversal in PagesController move endpoint](https://junglewise.ai/threats/cve-2026-65896-getgrav-grav-api-plugin-path-traversal-in-pagescontroller-move) (high, CVSS 7.1, published 23 Jul 2026) - [CVE-2026-65895: Grav API Plugin broken access control in ConfigController](https://junglewise.ai/threats/cve-2026-65895-grav-api-plugin-broken-access-control-in-configcontroller) (high, CVSS 8.5, published 23 Jul 2026) - [CVE-2026-65007: Grav api plugin missing authorization in API key generation](https://junglewise.ai/threats/cve-2026-65007-grav-api-plugin-missing-authorization-in-api-key-generation) (critical, CVSS 9.6, published 21 Jul 2026) - [CVE-2026-62233: getgrav grav-plugin-api privilege escalation in user management endpoints](https://junglewise.ai/threats/cve-2026-62233-getgrav-grav-plugin-api-privilege-escalation-in-user-management) (high, CVSS 8.8, published 17 Jul 2026) - [CVE-2026-62231: Grav API plugin authorization bypass in ApiKeyAuthenticator](https://junglewise.ai/threats/cve-2026-62231-grav-api-plugin-authorization-bypass-in-apikeyauthenticator) (high, CVSS 8.1, published 17 Jul 2026) - [CVE-2026-61452: Grav API plugin improper session invalidation in JWT access tokens](https://junglewise.ai/threats/cve-2026-61452-grav-api-plugin-improper-session-invalidation-in-jwt-access) (medium, CVSS 5.3, published 15 Jul 2026) - [CVE-2026-61451: Grav API plugin password reset token poisoning](https://junglewise.ai/threats/cve-2026-61451-grav-api-plugin-password-reset-token-poisoning) (critical, CVSS 9.6, published 15 Jul 2026) - [CVE-2026-61456: getgrav Grav API plugin stored XSS via SVG upload in media API](https://junglewise.ai/threats/cve-2026-61456-getgrav-grav-api-plugin-stored-xss-via-svg-upload-in-media-api) (medium, CVSS 4.6, published 10 Jul 2026) - [CVE-2026-11982: Grav CMS stored XSS in Admin2 Pages API](https://junglewise.ai/threats/cve-2026-11982-grav-cms-stored-xss-in-admin2-pages-api) (info, CVSS 5.1, published 18 Jun 2026) - [CVE-2026-42843: Grav API Plugin privilege escalation in UsersController](https://junglewise.ai/threats/cve-2026-42843-grav-api-plugin-privilege-escalation-in-userscontroller) (high, CVSS 8.8, published 11 May 2026) ## Most severe Grav API Plugin vulnerabilities - [CVE-2026-80203: Grav API Plugin authorization bypass in user management](https://junglewise.ai/threats/cve-2026-80203-grav-api-plugin-authorization-bypass-in-user-management) (critical, CVSS 9.8, published 26 Aug 2026) - [CVE-2026-112779: Grav API plugin cache exhaustion and authorization bypass](https://junglewise.ai/threats/cve-2026-112779-grav-api-plugin-grav-plugin-api-1-0-40-before-1-0-42-caches-a) (critical, CVSS 9.8, published 19 Oct 2026) - [CVE-2026-65007: Grav api plugin missing authorization in API key generation](https://junglewise.ai/threats/cve-2026-65007-grav-api-plugin-missing-authorization-in-api-key-generation) (critical, CVSS 9.6, published 21 Jul 2026) - [CVE-2026-61451: Grav API plugin password reset token poisoning](https://junglewise.ai/threats/cve-2026-61451-grav-api-plugin-password-reset-token-poisoning) (critical, CVSS 9.6, published 15 Jul 2026) - [CVE-2026-42843: Grav API Plugin privilege escalation in UsersController](https://junglewise.ai/threats/cve-2026-42843-grav-api-plugin-privilege-escalation-in-userscontroller) (high, CVSS 8.8, published 11 May 2026) - [CVE-2026-65897: Grav API Plugin privilege escalation in InvitationsController](https://junglewise.ai/threats/cve-2026-65897-grav-api-plugin-privilege-escalation-in-invitationscontroller) (high, CVSS 8.8, published 23 Jul 2026) - [CVE-2026-62233: getgrav grav-plugin-api privilege escalation in user management endpoints](https://junglewise.ai/threats/cve-2026-62233-getgrav-grav-plugin-api-privilege-escalation-in-user-management) (high, CVSS 8.8, published 17 Jul 2026) - [CVE-2026-65895: Grav API Plugin broken access control in ConfigController](https://junglewise.ai/threats/cve-2026-65895-grav-api-plugin-broken-access-control-in-configcontroller) (high, CVSS 8.5, published 23 Jul 2026) - [CVE-2026-62667: Grav API Plugin API key scope bypass](https://junglewise.ai/threats/cve-2026-62667-grav-api-plugin-api-key-scope-bypass) (high, CVSS 8.1, published 19 Aug 2026) - [CVE-2026-62231: Grav API plugin authorization bypass in ApiKeyAuthenticator](https://junglewise.ai/threats/cve-2026-62231-grav-api-plugin-authorization-bypass-in-apikeyauthenticator) (high, CVSS 8.1, published 17 Jul 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 6 | 0 | 0 | | 24 Aug 2026 | 3 | 1 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 1 | 1 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Grav technologies - [Grav](https://junglewise.ai/threats/technologies/grav): 63 vulnerabilities - [Grav Login Plugin](https://junglewise.ai/threats/technologies/login-plugin): 5 vulnerabilities - [Grav Form Plugin](https://junglewise.ai/threats/technologies/form-plugin): 4 vulnerabilities - [Grav Flex Objects](https://junglewise.ai/threats/technologies/flex-objects): 3 vulnerabilities - [Grav CMS](https://junglewise.ai/threats/technologies/grav-cms-1): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Grav API Plugin vulnerabilities", https://junglewise.ai/threats/technologies/api-plugin, 12 November 2026.