CVE-2026-65895 is a high-severity vulnerability affecting Grav API Plugin versions prior to 1.0.10. The issue arises from missing authorization checks that fail to restrict write access to security-critical plugin configuration scopes. Authenticated users possessing the api.config.write privilege can exploit this flaw to disable site-wide rate limiting and reconfigure CORS policies to include attacker-controlled origins with credentials enabled. This misconfiguration can enable credential brute-force attacks and unauthorized cross-origin resource sharing, increasing the risk of compromise.

The vulnerability allows attackers with certain authenticated privileges to disable rate limiting, which can lead to credential brute-force attacks against the site. Additionally, attackers can modify CORS policies to include malicious origins with credentials enabled, potentially exposing sensitive data or enabling unauthorized actions via cross-origin requests.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is available, restrict the api.config.write privilege to trusted users only and monitor configuration changes closely to detect unauthorized modifications.