CVE-2026-63407: CWE-942: Permissive Cross-domain Policy with Untrusted Domains in getgrav grav-plugin-api

The Grav API Plugin's CorsMiddleware prior to version 1.0.0-rc.16 returns Access-Control-Allow-Origin: * and permissive OPTIONS responses on authenticated /api/v1 endpoints. This allows cross-origin JavaScript to use attacker-obtained JWT tokens in Authorization or X-API-Token headers to read authenticated responses and perform write operations with the token owner's privileges. This vulnerability is classified as CWE-942 (Permissive Cross-domain Policy with Untrusted Domains) and is fixed in version 1.0.0-rc.16.

An attacker can exploit this vulnerability to exfiltrate data and modify accounts by submitting attacker-controlled JWT tokens via cross-origin requests. This leads to unauthorized read and write access to authenticated API endpoints, compromising confidentiality and integrity of user data. The CVSS 3.1 score is 8.2 (high severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact.

Upgrade the Grav API Plugin to version 1.0.0-rc.16 or later, where the permissive CORS policy issue is fixed. No other mitigation is required once the plugin is updated.