The Grav API plugin’s CorsMiddleware erroneously returns a wildcard Access‑Control‑Allow‑Origin header and permissive OPTIONS responses for authenticated /api/v1 endpoints. This allows a script from any origin to send an attacker‑obtained JSON Web Token via the Authorization or X‑API‑Token header, read the protected data, and carry out write operations with the token holder’s privileges. The resulting uncontrolled resource sharing (CWE‑942) enables data exfiltration and account modification.

The issue affects the Grav CMS API plugin product (getgrav:grav-plugin-api) versions earlier than 1.0.0‑rc.16. All installations that use those releases are vulnerable until the plugin is upgraded to 1.0.0‑rc.16 or later.

With a CVSS score of 8.2 the vulnerability is considered High and introduces a substantial risk to confidentiality and integrity. The exploit does not require elevated privileges on the server; it only needs a valid JWT, which can be obtained during normal authenticated API usage or via social engineering. Attackers can deliver malicious JavaScript from any website leveraging the permissive CORS policy, making the path for exploitation straightforward. The EPSS score of 0.271% indicates a very low exploitation probability, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, suggesting limited evidence of active exploitation at this time. Nonetheless the combination of high CVSS and easy cross‑origin attack vector warrants prompt remediation.