CVE-2026-62387 describes a vulnerability in the Grav API plugin (getgrav/grav-plugin-api) where versions prior to 1.0.0-rc.16 shipped with a default CORS policy that allowed all origins via Access-Control-Allow-Origin: *. This included authenticated endpoints and OPTIONS preflight responses. Since the plugin accepts credentials through Authorization and X-API-Token headers set by JavaScript, an attacker with a valid token (obtained through means such as log leakage or network capture) can issue fully authenticated cross-origin requests from malicious websites. This enables unauthorized reading and writing of data as the token's user. The vulnerability was addressed and fixed in version 1.0.0-rc.16.

An attacker who obtains a valid access token can exploit the overly permissive CORS policy to perform authenticated cross-origin requests, potentially reading sensitive data and performing write operations with the privileges of the compromised token's user. This elevates the risk of data exposure and unauthorized actions within the affected Grav API plugin versions.

Upgrade to version 1.0.0-rc.16 or later, where the CORS policy has been corrected to restrict Access-Control-Allow-Origin appropriately. Since the fix is included in 1.0.0-rc.16, applying this update fully mitigates the vulnerability. Patch status is confirmed fixed in 1.0.0-rc.16.