What is CVE-2026-61452?

CVE-2026-61452 is a medium-severity vulnerability in Getgrav Grav, classified under Insufficient Session Expiration. CVSS score: 5.3/10. Published 2026-07-15.

How severe is CVE-2026-61452?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Getgrav Grav

CVE-2026-61452

The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. An attacker who has stolen an access token retains full API access until the token naturally expires.

EPSS: 0.003 (24.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Getgrav Grav — versions 0, 2.0.4

Weakness classification (CWE)

CWE-613 — Insufficient Session Expiration

References

GitHub Security Advisory (GHSA-m8g9-wxhx-6f86) (vendor-advisory)
VulnCheck Advisory: Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens (third-party-advisory)

Frequently asked questions

What is CVE-2026-61452?: CVE-2026-61452 is a medium-severity vulnerability in Getgrav Grav, classified under Insufficient Session Expiration. CVSS score: 5.3/10. Published 2026-07-15.
How severe is CVE-2026-61452?: Medium severity. CVSS v3 base score is 5.3 out of 10.