CVE-2026-109320: Insufficient Session Expiration in getgrav grav-plugin-api
Description
CVE-2026-109320 is a vulnerability in the Grav API plugin (grav-plugin-api) before version 1.0.36. It involves improper session validation where disabled user accounts can continue to access API endpoints by reusing existing authorized sessions. This occurs because the SessionAuthenticator does not enforce the current account state, allowing disabled users to bypass revocation until their session expires.
CVSS v4.0
Score 5.3medium
Affected software
getgrav
grav-plugin-api
pkg:github/grav-plugin-apiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Grav API plugin (grav-plugin-api) versions prior to 1.0.36 contain an insufficient session expiration vulnerability. Specifically, the SessionAuthenticator component fails to check whether an account has been disabled before allowing continued API access via an existing authorized browser or remember-me session. As a result, disabled users can maintain API access until their session naturally expires, effectively defeating operator attempts to revoke access immediately.
Potential Impact
Disabled user accounts retain API access through existing sessions until those sessions expire, potentially allowing unauthorized API calls despite account revocation. This undermines access control and session management policies, increasing the risk of unauthorized actions via the API.
Mitigation Recommendations
Upgrade grav-plugin-api to version 1.0.36 or later, where this session validation issue is fixed. Since this is an on-premises plugin, operators must apply the update manually. Patch status is confirmed by the affectedVersions field indicating versions before 1.0.36 are vulnerable.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T14:15:29.011Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd0c152cdf04f656b11bf6
Added to database: 10/12/2026, 16:34:29 UTC
Last enriched: 10/12/2026, 17:04:25 UTC
Last updated: 10/12/2026, 21:46:45 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.