CVE-2026-63407 in API Plugin
Summary
by MITRE • 08/19/2026
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticated /api/v1 endpoints. JavaScript from any origin can submit an attacker-obtained JWT through the Authorization or X-API-Token header, read the authenticated response, and perform write operations with the token owner's privileges, enabling data exfiltration and account modification. This issue is fixed in version 1.0.0-rc.16.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The Grav API Plugin serves as a RESTful interface for the Grav content management system, allowing developers to interact with site content programmatically through headless access. A critical security flaw was identified within the CorsMiddleware component prior to version 1.0.0-rc.16, where the middleware incorrectly configured Cross-Origin Resource Sharing policies for authenticated endpoints under the /api/v1 path. Specifically, the plugin returned an Access-Control-Allow-Origin header with a wildcard value of asterisk and provided permissive responses to HTTP OPTIONS requests. This configuration effectively disabled browser-enforced same-origin policy protections for these sensitive API routes, creating a significant vector for cross-site request forgery and data exfiltration attacks against authenticated users.
The technical flaw allows JavaScript code hosted on any arbitrary domain to interact with the Grav API endpoints that require authentication. Because the server explicitly permits requests from all origins, an attacker can craft malicious web pages or scripts that automatically submit HTTP requests containing a valid JSON Web Token obtained through separate means, such as session hijacking or token leakage via other vulnerabilities. These tokens are transmitted either in the Authorization header or the X-API-Token header. Due to the permissive CORS policy, the browser does not block these cross-origin requests, and the server processes them as legitimate authenticated actions. This enables an attacker to read sensitive data returned by the API and execute write operations that modify site content or user accounts using the privileges of the token owner.
The operational impact of this vulnerability is severe, particularly for sites relying on single-page applications or external services that consume the Grav API. Attackers can perform unauthorized data exfiltration by reading protected resources such as private pages, user profiles, or configuration details. Furthermore, the ability to execute write operations means an attacker could alter site content, delete entries, or modify administrative settings if the compromised token holds elevated privileges. This effectively bypasses authentication controls in a client-side context, turning any leaked JWT into a full account takeover mechanism without requiring direct access to the victim's session cookies or local storage through traditional cross-site scripting vectors alone.
This vulnerability aligns with CWE-942, which describes Permissive Cross-domain Policy with Untrusted Domains, and falls under MITRE ATT&CK technique T1505.003, Server Software Component: Web Framework. The root cause lies in the misconfiguration of security headers that fail to restrict origins to a trusted whitelist or properly handle preflight requests for authenticated endpoints. To mitigate this issue, administrators must upgrade the Grav API Plugin to version 1.0.0-rc.16 or later, where the CorsMiddleware has been corrected to enforce strict origin validation and appropriate handling of OPTIONS requests for protected routes. Additionally, implementing robust Content Security Policy headers and ensuring that JWTs are not exposed through insecure channels can provide defense-in-depth against such cross-origin attacks.