Improper Session Validation in Grav API Plugin by Grav Technologies
CVE-2026-109320

5.3MEDIUM

Key Information:

Vendor

Getgrav

Status
Grav-plugin-api
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109320?

The Grav API Plugin is vulnerable due to improper session validation, allowing disabled accounts to retain API access. The SessionAuthenticator fails to enforce the account state, enabling disabled users to reuse previously authorized sessions to access API endpoints until they expire. This flaw compromises security by allowing unauthorized users the ability to interact with the API despite their account being disabled, effectively undermining operator revocation efforts.

Affected Version(s)

grav-plugin-api 0 < 1.0.36

grav-plugin-api 1.0.36

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
vendor-advisorythird-party-advisory
https://www.vulncheck.com/advisories/grav-api-plugin-befo...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AlpetGexha
.