Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: getgrav grav 1.0.10 Clear all filters
TI-2026-46937 CVE-2026-65897 · GHSA-xcm3-8jr8-4m46

Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups

Priority HIGH 73

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permis…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00458 Published 2026-07-23 Fixed in 1.0.10 CWE-269
TI-2026-46936 CVE-2026-65896 · GHSA-hc3p-4h64-j8wr

Grav API Plugin before 1.0.10 Path Traversal via move

Priority MEDIUM 64

Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00324 Published 2026-07-23 Fixed in 1.0.10 CWE-73
TI-2026-46935 CVE-2026-65895 · GHSA-cvg5-68p3-p7qp

Grav API Plugin before 1.0.10 Broken Access Control

Priority HIGH 69

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS setting…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00295 Published 2026-07-23 Fixed in 1.0.10 CWE-862