Getgrav Grav-Plugin-Api
15 CVEs affecting Getgrav Grav-Plugin-Api. Latest disclosed: 2026-10-19. Critical: 1, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-112779 | Critical | 9.8 | 2026-10-19 | Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET… |
CVE-2026-62666 | High | 8.8 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::creat… |
CVE-2026-72833 | High | 8.8 | 2026-08-14 | The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-… |
CVE-2026-42843 | High | 8.8 | 2026-05-11 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Pr… |
CVE-2026-63407 | High | 8.2 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddlewa… |
CVE-2026-62667 | High | 8.1 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::gen… |
CVE-2026-63408 | High | 7.5 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenti… |
CVE-2026-109317 | High | 7.2 | 2026-10-12 | Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing po… |
CVE-2026-109320 | Medium | 5.4 | 2026-10-12 | The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, bec… |
CVE-2026-61607 | Medium | 4.6 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media… |
CVE-2026-86196 | | 2026-09-05 | Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated atta… | |
CVE-2026-86195 | | 2026-09-05 | grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only remove… | |
CVE-2026-86193 | | 2026-09-05 | grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-a… | |
CVE-2026-64852 | | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the api… | |
CVE-2026-62668 | | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController… |