Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: getgrav grav 1.0.14 Clear all filters
TI-2026-53082 CVE-2026-75836 · GHSA-cx7m-jmr8-28mw

Grav API Plugin before 1.0.14 Missing Authorization

Priority HIGH 73

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction().

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00469 Published 2026-08-18 Fixed in 1.0.14 CWE-862
TI-2026-53081 CVE-2026-75835 · GHSA-c746-wcwc-p482

Grav API Plugin before 1.0.14 Missing Authorization

Priority HIGH 73

Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php).

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00308 Published 2026-08-18 Fixed in 1.0.14 CWE-862
TI-2026-53079 CVE-2026-75833 · GHSA-chr5-7vjc-3p97

Grav API Plugin Open Redirect via Backslash Bypass

Priority HIGH 72

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo().

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.00219 Published 2026-08-18 Fixed in 1.0.14 CWE-601
TI-2026-53078 CVE-2026-75832 · GHSA-xgr3-7x2w-f8vc

Grav API Plugin before 1.0.14 Authorization Bypass

Priority MEDIUM 40

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope().

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00298 Published 2026-08-18 Fixed in 1.0.14 CWE-862