Description

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticated /api/v1 endpoints. JavaScript from any origin can submit an attacker-obtained JWT through the Authorization or X-API-Token header, read the authenticated response, and perform write operations with the token owner's privileges, enabling data exfiltration and account modification. This issue is fixed in version 1.0.0-rc.16.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-19T16:18:37.863Z",
  "pubdate": "2026-08-19T16:18:37.863Z",
  "executiveSummary": "The Grav API Plugin for Grav CMS contains a Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability affecting authenticated RESTful API endpoints prior to version 1.0.0-rc.16.\nThe vulnerability stems from the CorsMiddleware returning an overly permissive Access-Control-Allow-Origin: * header alongside permissive OPTIONS responses for authenticated /api/v1 endpoints.\nThis security flaw allows malicious JavaScript executing within a victim's browser context from any arbitrary origin to interact with the API.\nAn attacker can leverage this by supplying an attacker-obtained JSON Web Token (JWT) through either the Authorization or X-API-Token header.\nSuccessful exploitation enables unauthorized cross-origin reading of sensitive authenticated responses and the execution of arbitrary write operations utilizing the compromised token owner's privileges.\nThe resulting impact includes unauthorized data exfiltration and account modification.\nMitigation requires updating the Grav API Plugin to version 1.0.0-rc.16 or later, where the CORS policy for authenticated endpoints has been properly restricted.",
  "technicalDetails": "The vulnerability resides in the CorsMiddleware component of the Grav API Plugin, which handles Cross-Origin Resource Sharing headers for incoming HTTP requests to the RESTful API endpoints.\nPrior to version 1.0.0-rc.16, the middleware improperly enforces CORS policies by responding with a wildcard Access-Control-Allow-Origin: * header and excessively permissive OPTIONS preflight responses even when processing requests directed toward authenticated /api/v1 endpoints.\nUnder standard browser security policies, the Same-Origin Policy (SOP) restricts scripts from different origins from reading responses of authenticated API requests unless explicitly permitted by CORS headers.\nBecause the CorsMiddleware emits overly permissive headers for sensitive endpoints, browsers bypass SOP restrictions and allow arbitrary external web origins to read responses containing confidential data.\nThe attack flow proceeds as follows: First, an attacker acquires a valid user or administrator JWT, either through prior compromise, social engineering, or a separate leakage vector.\nNext, the attacker induces a victimized user to visit a malicious website hosting hostile JavaScript payloads.\nThe malicious script constructs an XMLHttpRequest or Fetch API request targeting the vulnerable Grav CMS instance's /api/v1 endpoints.\nThe script attaches the obtained JWT within the Authorization header or the X-API-Token header of the cross-origin request.\nDue to the misconfigured CorsMiddleware returning Access-Control-Allow-Origin: *, the victim's browser accepts the server's response and exposes it to the malicious script.\nThe attacker can then perform unauthorized read operations to exfiltrate sensitive site content and execute unauthorized write operations, such as modifying administrative accounts or altering site configurations, completely inheriting the privileges associated with the provided token owner.\nThe vulnerable component is the CorsMiddleware within the Grav API Plugin, affecting all versions prior to 1.0.0-rc.16.\nThe attack is network-exploitable, requires the target to process cross-origin requests with exposed authentication tokens, and violates the principle of least privilege regarding resource sharing."
}