CVE-2026-62387

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.0-rc.16

Description The plugin uses a default Cross-Origin Resource Sharing (CORS) configuration that sets the Access-Control-Allow-Origin header to * on all responses, including preflight (OPTIONS) responses and authenticated endpoints. This configuration allows any malicious website to issue authenticated cross-origin requests if an attacker obtains a valid access token through methods such as log leakage, browser history, network capture, or Referer headers. The plugin accepts credentials via the Authorization and X-API-Token headers, which are set programmatically by JavaScript. An attacker can leverage this to read sensitive data or perform write operations on behalf of the user associated with the token.

Recommendations Update Grav API plugin to version 1.0.0-rc.16.