GetGrav API Plugin up to 1.0.0-rc.15 CorsMiddleware cross-domain policy

Summaryinfo

A vulnerability identified as problematic has been detected in GetGrav API Plugin up to 1.0.0-rc.15. This issue affects some unknown processing of the component CorsMiddleware. This manipulation causes cross-domain policy. The identification of this vulnerability is CVE-2026-63407. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in GetGrav API Plugin up to 1.0.0-rc.15. It has been declared as problematic. Affected by this vulnerability is some unknown functionality of the component CorsMiddleware. The manipulation with an unknown input leads to a cross-domain policy vulnerability. The CWE definition for the vulnerability is CWE-942. The product uses a cross-domain policy file that includes domains that should not be trusted. As an impact it is known to affect confidentiality. The summary by CVE is:

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticated /api/v1 endpoints. JavaScript from any origin can submit an attacker-obtained JWT through the Authorization or X-API-Token header, read the authenticated response, and perform write operations with the token owner's privileges, enabling data exfiltration and account modification. This issue is fixed in version 1.0.0-rc.16.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-63407 since 07/16/2026. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.0.0-rc.16 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• GetGrav

Name

• API Plugin

Version

• 1.0.0-rc.0
• 1.0.0-rc.1
• 1.0.0-rc.2
• 1.0.0-rc.3
• 1.0.0-rc.4
• 1.0.0-rc.5
• 1.0.0-rc.6
• 1.0.0-rc.7
• 1.0.0-rc.8
• 1.0.0-rc.9
• 1.0.0-rc.10
• 1.0.0-rc.11
• 1.0.0-rc.12
• 1.0.0-rc.13
• 1.0.0-rc.14
• 1.0.0-rc.15

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion