CORS Misconfiguration in Grav API Plugin Affecting Grav CMS

CVE-2026-62387

What is CVE-2026-62387?

The Grav API plugin, prior to version 1.0.0-rc.16, introduced a serious CORS misconfiguration by setting Access-Control-Allow-Origin to '*'. This issue affects all responses, including authenticated endpoints and preflight (OPTIONS) responses. As the plugin allows the use of credentials through headers like Authorization and X-API-Token (managed programmatically via JavaScript), an attacker can exploit this flaw to make fully authenticated cross-origin requests from any malicious site. This could lead to unauthorized access to sensitive data or the ability to perform write operations as the authenticated user. This vulnerability has been addressed in version 1.0.0-rc.16.

References