CVE-2026-109320
Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.
| CWE | CWE-613 |
| Vendor | getgrav |
| Product | grav-plugin-api |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for getgrav grav-plugin-api
Be the first to know when new medium vulnerabilities affecting getgrav grav-plugin-api are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
getgrav / grav-plugin-api
0 < 1.0.36
References
Credits
🔍 AlpetGexha