PT-2026-110737 · Grav · Grav-Plugin-Api

Alpetgexha

·

CVE-2026-109320

·

Published

2026-10-12

·

Updated

2026-10-12

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Grav API plugin (grav-plugin-api) versions prior to 1.0.36
Description Improper session validation occurs because the SessionAuthenticator function does not enforce account state. This allows disabled accounts to maintain API access by reusing an already authorized browser or remember-me session to call API endpoints until the session expires, which bypasses operator revocation.
Recommendations Update Grav API plugin (grav-plugin-api) to version 1.0.36 or later.

Exploit

Fix

Insufficient Session Expiration

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-109320
GHSA-7QFJ-82Q8-FRW6

Affected Products

Grav-Plugin-Api