Description
The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Account Access
Action: Patch Now
AI Analysis

Impact

The Grav API plugin contains a flaw where session validation does not check whether a user account is disabled. A disabled user can reuse an existing authenticated browser session or a remember‑me token to access API endpoints until the session expires, effectively enabling continued API access even after revocation.

Affected Systems

This vulnerability affects the Grav API plugin (grav-plugin-api) from the getgrav vendor, specifically all releases prior to version 1.0.36.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local or remote, depending on how the disabled user obtained an authenticated session; an attacker would need an existing session token, which is then reused to call API endpoints, so the risk depends on how quickly disabled accounts are logged out or sessions are invalidated.

Generated by OpenCVE AI on October 12, 2026 at 19:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Grav API plugin to version 1.0.36 or later.
  • Immediately terminate all active sessions or remember‑me tokens for disabled accounts.
  • Deploy a temporary server‑side rule or middleware that rejects API requests from disabled accounts until the plugin update is applied.

Generated by OpenCVE AI on October 12, 2026 at 19:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.
Title Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
First Time appeared Getgrav
Getgrav grav-plugin-api
Weaknesses CWE-613
CPEs cpe:2.3:a:getgrav:grav-plugin-api:*:*:*:*:*:*:*:*
Vendors & Products Getgrav
Getgrav grav-plugin-api
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Getgrav Grav-plugin-api
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T18:12:07.342Z

Reserved: 2026-10-12T14:15:29.011Z

Link: CVE-2026-109320

cve-icon Vulnrichment

Updated: 2026-10-13T18:11:52.792Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T17:17:27.097

Modified: 2026-10-16T19:21:14.417

Link: CVE-2026-109320

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T10:45:07Z

Weaknesses
  • CWE-613

    Insufficient Session Expiration