CVE-2026-63407: CWE-942: Permissive Cross-domain Policy with Untrusted Domains in getgrav grav-plugin-api
The Grav API Plugin for Grav CMS prior to version 1.0.0-rc.16 has a permissive cross-origin resource sharing (CORS) policy that allows JavaScript from any origin to submit attacker-obtained JWT tokens and perform authenticated API operations. This vulnerability enables unauthorized data exfiltration and account modification by abusing the Access-Control-Allow-Origin: * header and permissive OPTIONS responses. The issue is fixed in version 1.0.0-rc.16.
AI Analysis
Technical Summary
CVE-2026-63407 describes a vulnerability in the Grav API Plugin for Grav CMS where the CorsMiddleware component returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticated /api/v1 endpoints prior to version 1.0.0-rc.16. This allows JavaScript from any origin to submit attacker-obtained JWT tokens via Authorization or X-API-Token headers, read authenticated responses, and perform write operations with the token owner's privileges. This cross-domain policy weakness (CWE-942) can lead to data exfiltration and account modification. The vulnerability is resolved in version 1.0.0-rc.16.
Potential Impact
An attacker can exploit the permissive CORS policy to use stolen JWT tokens to perform authenticated API requests from any origin, potentially exfiltrating sensitive data and modifying user accounts. This compromises confidentiality and integrity of the affected system. The CVSS score of 8.2 reflects a high severity due to network attack vector, low attack complexity, no privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact.
Mitigation Recommendations
Upgrade the Grav API Plugin to version 1.0.0-rc.16 or later, where the permissive CORS policy issue is fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed fixed in 1.0.0-rc.16.
CVE-2026-63407: CWE-942: Permissive Cross-domain Policy with Untrusted Domains in getgrav grav-plugin-api
Description
The Grav API Plugin for Grav CMS prior to version 1.0.0-rc.16 has a permissive cross-origin resource sharing (CORS) policy that allows JavaScript from any origin to submit attacker-obtained JWT tokens and perform authenticated API operations. This vulnerability enables unauthorized data exfiltration and account modification by abusing the Access-Control-Allow-Origin: * header and permissive OPTIONS responses. The issue is fixed in version 1.0.0-rc.16.
CVSS v3.1
Score 8.2high
Affected software
pkg:github/getgrav/grav-plugin-apiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-63407 describes a vulnerability in the Grav API Plugin for Grav CMS where the CorsMiddleware component returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticated /api/v1 endpoints prior to version 1.0.0-rc.16. This allows JavaScript from any origin to submit attacker-obtained JWT tokens via Authorization or X-API-Token headers, read authenticated responses, and perform write operations with the token owner's privileges. This cross-domain policy weakness (CWE-942) can lead to data exfiltration and account modification. The vulnerability is resolved in version 1.0.0-rc.16.
Potential Impact
An attacker can exploit the permissive CORS policy to use stolen JWT tokens to perform authenticated API requests from any origin, potentially exfiltrating sensitive data and modifying user accounts. This compromises confidentiality and integrity of the affected system. The CVSS score of 8.2 reflects a high severity due to network attack vector, low attack complexity, no privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact.
Mitigation Recommendations
Upgrade the Grav API Plugin to version 1.0.0-rc.16 or later, where the permissive CORS policy issue is fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed fixed in 1.0.0-rc.16.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-16T19:20:28.987Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a85d4edacd9273b494d33c8
Added to database: 08/19/2026, 16:08:13 UTC
Last enriched: 08/19/2026, 16:22:35 UTC
Last updated: 08/19/2026, 21:03:18 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.