The Grav API plugin (getgrav/grav-plugin-api) before version 1.0.0-rc.16 accepts JWT access tokens passed via the ?token URL query parameter on every API route. Because these tokens are embedded in URLs, they become visible in web server access logs, the Referer header, browser history, and upstream proxy or CDN logs, exposing valid admin access tokens. A leaked token grants full unauthorized API access, allowing reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.

The vulnerability affects the Grav API plugin on Grav installations running any version earlier than 1.0.0-rc.16. The affected vendor is getgrav and the product is Grav.

The CVSS score of 8.2 indicates a high severity level. The EPSS score of less than 1% suggests a low probability that this flaw will be exploited in practice, and it is not listed in the CISA KEV catalog. The likely attack vector is an HTTP request to any API route that includes a ?token query parameter, which exposes the JWT in logs and the Referer header. With a valid token an attacker can read sensitive data, create privileged accounts, alter system settings, and delete content.