Getgrav

Grav-plugin-api

12 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.7

CVE-2026-64852

  • EPSS 0.3%
  • Veröffentlicht 19.08.2026 16:00:06
  • Zuletzt bearbeitet 19.08.2026 18:17:10

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the cal...

7.5

CVE-2026-63408

  • EPSS 0.36%
  • Veröffentlicht 19.08.2026 15:53:08
  • Zuletzt bearbeitet 19.08.2026 19:17:22

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/...

8.2

CVE-2026-63407

  • EPSS 0.27%
  • Veröffentlicht 19.08.2026 15:51:36
  • Zuletzt bearbeitet 19.08.2026 16:18:37

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticate...

8.1

CVE-2026-62667

  • EPSS 0.29%
  • Veröffentlicht 19.08.2026 15:43:19
  • Zuletzt bearbeitet 19.08.2026 16:18:19

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not...

8.8

CVE-2026-62666

  • EPSS 0.43%
  • Veröffentlicht 19.08.2026 15:36:37
  • Zuletzt bearbeitet 21.08.2026 20:16:38

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used b...

9.4

CVE-2026-62668

  • EPSS 0.33%
  • Veröffentlicht 19.08.2026 15:29:24
  • Zuletzt bearbeitet 19.08.2026 19:17:21

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispa...

4.6

CVE-2026-61607

  • EPSS 0.21%
  • Veröffentlicht 19.08.2026 15:18:15
  • Zuletzt bearbeitet 21.08.2026 20:16:37

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension...

7.1

CVE-2026-75830

  • EPSS 0.28%
  • Veröffentlicht 18.08.2026 11:19:42
  • Zuletzt bearbeitet 18.08.2026 15:17:14

grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter...

8.6

CVE-2026-72828

  • EPSS 0.27%
  • Veröffentlicht 14.08.2026 11:35:35
  • Zuletzt bearbeitet 17.08.2026 16:17:45

Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() check rather than a scope-aware permission check, so ...

8.8

CVE-2026-72826

  • EPSS 0.3%
  • Veröffentlicht 14.08.2026 11:35:34
  • Zuletzt bearbeitet 24.08.2026 11:16:40

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access...