Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: getgrav grav-plugin-api 1.0.20 Clear all filters
TI-2026-58985 CVE-2026-86196 · GHSA-gg9g-7x93-5gq2

Grav API Plugin before 1.0.20 Authentication Bypass via Host Header

Priority HIGH 73

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains…

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00435 Published 2026-09-05 Fixed in 1.0.20 CWE-290
TI-2026-58984 CVE-2026-86195 · GHSA-rg66-gwrp-wj75

grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag

Priority HIGH 73

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip dot-keyed equivalents…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00387 Published 2026-09-05 Fixed in 1.0.20 CWE-269
TI-2026-58982 CVE-2026-86193 · GHSA-6rq7-cjmj-rc58

Grav API Plugin Authentication Bypass via Group-Inherited Super

Priority HIGH 73

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00364 Published 2026-09-05 Fixed in 1.0.20 CWE-863