CVE-2026-109320

MediumCVSS 5.4

Published: 12/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.

Risk Assessment

The risk includes unauthorized API access by disabled accounts, potentially leading to data breaches or unauthorized operations.

Recommendation

Update the Grav API plugin to version 1.0.36 or later, which includes a fix enforcing account state during session validation.

Other vulnerabilities in Grav API

CVE-2026-42844High
Grav is a file-based web platform. In version 2.0.0-beta.2, a low-privileged authenticated API user can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges, resulting in full administrative compromise of the Grav API.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS