Skip to content
Threat Feed
Subscribe

Product

Grav API Plugin

3 briefs RSS
critical advisory

Remote Code Execution in Grav API Plugin via Privilege Escalation

The Grav API plugin before version 1.0.13 fails to enforce API key scope restrictions in ConfigController, enabling remote code execution via injected scheduler commands.

Grav API plugin remote-code-execution privilege-escalation web-application-vulnerability
1r 3t 1c updated
high advisory

Grav API Plugin Privilege Escalation via Invitation Group Manipulation (CVE-2026-65897)

An authenticated attacker can exploit CVE-2026-65897 in Grav API Plugin versions prior to 1.0.10 by manipulating the 'groups' field during invitation creation, allowing invited accounts to gain super-admin API access, leading to privilege escalation.

Grav API Plugin privilege-escalation vulnerability
1t 1c 4i
high advisory

CVE-2026-58656 - Grav API Plugin Cross-Origin Authentication Bypass and Account Takeover

A critical vulnerability, CVE-2026-58656, in the Grav API plugin before v1.0.0-rc.16 allows unauthenticated attackers to perform fully authenticated cross-origin API requests by leveraging leaked JWT tokens via the `?token=` URL query parameter and the `Access-Control-Allow-Origin: *` response header, potentially leading to persistent backdoor super-admin accounts and sensitive data exfiltration.

Grav API plugin grav api-plugin jwt cors remote-code-execution web-vulnerability
1r 3t 1c