CVE-2026-109320 getgrav CVE debrief

Who should care

Operators and administrators of the Grav API plugin should be aware of this vulnerability and take necessary actions to mitigate it. This includes updating the plugin to version 1.0.36 or later and reviewing active sessions of disabled accounts.

Why it matters

The vulnerability in the Grav API plugin before version 1.0.36 allows disabled accounts to maintain API access, bypassing operator revocation. This requires defenders to update the plugin, review and revoke active sessions of disabled accounts, and monitor API access.

• Defenders should verify if they are using a vulnerable version of the Grav API plugin and prioritize updating to version 1.0.36 or later.
• Operators need to review and revoke any active sessions of disabled accounts to prevent unauthorized access.
• Defenders should monitor API access for disabled accounts to detect potential exploitation.
• Verification of session revocation and API access controls is necessary to ensure that the vulnerability is properly mitigated.

Technical summary

The Grav API plugin before version 1.0.36 contains an improper session validation vulnerability. This vulnerability allows disabled accounts to maintain API access because the SessionAuthenticator does not enforce account state. As a result, disabled users can reuse an already authorized browser or remember-me session to call API endpoints until the session expires, effectively bypassing operator revocation of access.

Defensive priority

Operators should prioritize updating the Grav API plugin to version 1.0.36 or later to mitigate this vulnerability. They should also review and revoke any active sessions of disabled accounts.

Recommended defensive actions

• Update the Grav API plugin to version 1.0.36 or later
• Review and revoke active sessions of disabled accounts
• Monitor API access for disabled accounts
• Verify session revocation and API access controls
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details about the vulnerability in the Grav API plugin. The vulnerability allows disabled accounts to keep API access due to improper session validation. The SessionAuthenticator does not enforce account state, enabling disabled users to reuse authorized sessions until expiry.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.