Vulnerability in Getgrav Grav
CVE-2026-62386
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (36.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 36.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Getgrav Grav — versions 0, 1.0.0-rc.16
Weakness classification (CWE)
References
- github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq (vendor-advisory)
- www.vulncheck.com/advisories/grav-rc-16-authentication-bypass-via-token-url-par… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-62386?
- CVE-2026-62386 is a high-severity vulnerability in Getgrav Grav, classified under CWE-598. CVSS score: 7.5/10. Published 2026-07-17.
- How severe is CVE-2026-62386?
- High severity. CVSS v3 base score is 7.5 out of 10.