Getgrav Grav-Plugin-Api
11 CVEs affecting Getgrav Grav-Plugin-Api. Latest disclosed: 2026-09-05. Critical: 0, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-62666 | High | 8.8 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::creat… |
CVE-2026-42843 | High | 8.8 | 2026-05-11 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Pr… |
CVE-2026-63407 | High | 8.2 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddlewa… |
CVE-2026-62667 | High | 8.1 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::gen… |
CVE-2026-63408 | High | 7.5 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenti… |
CVE-2026-61607 | Medium | 4.6 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media… |
CVE-2026-86196 | | 2026-09-05 | Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated atta… | |
CVE-2026-86195 | | 2026-09-05 | grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only remove… | |
CVE-2026-86193 | | 2026-09-05 | grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-a… | |
CVE-2026-64852 | | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the api… | |
CVE-2026-62668 | | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController… |