The Grav API plugin shipped with a default CORS configuration that set Access‑Control‑Allow‑Origin to '*', allowing any origin to reach all plugin responses, including authenticated endpoints. Because the plugin accepts credentials through the Authorization and X‑API‑Token headers, an attacker who can obtain a valid token—through log leakage, referer headers, browser history, or network capture—can use a malicious website to issue fully authenticated cross‑origin requests. The result is that an authenticated user’s data can be read or altered without the user’s knowledge, a classic CORS misconfiguration leading to potential data disclosure and unauthorized data modification. This weakness is documented as CWE‑942. The CVSS score of 7.1 reflects the severity of this functional impact.

Any Grav installation that uses the getgrav/grav-plugin-api before version 1.0.0-rc.16 is affected. That includes distributions in which the plugin is present in release versions earlier than 1.0.0-rc.16 and any custom sites that have not upgraded the plugin to the fixed release.

The EPSS score is less than 1%, indicating the current exploit probability is low, and the vulnerability is not yet listed in CISA’s KEV catalog. However, the exploit path is straightforward once a token is compromised: a malicious page can send authenticated requests with the stolen token, exposing sensitive data or performing desired state changes. The knowledge that a correctly authenticated request can be spoofed across origins, combined with the low likelihood of token exposure, places this issue in the moderate‑high risk category according to the CVSS rating. The potential impact on confidentiality and integrity is significant if a token is leaked, but the overall attack surface is limited to sites exposed to token leakage via client‑side logging or network interception.