CVE-2026-61451 getgrav CVE debrief

Who should care

Defenders responsible for Grav installations, particularly those using the Grav API plugin, should assess exposure and apply necessary patches or mitigations. They should also review compensating controls for exposed systems and monitor for suspicious password reset activity. Security teams and vulnerability management teams should prioritize verifying exposure of Grav API plugin versions before 1.0.4 and apply the patch or mitigation measures.

Why it matters

CVE-2026-61451 is a critical vulnerability in the Grav API plugin that allows unauthenticated attackers to poison password reset tokens, potentially leading to full account takeover. Defenders should prioritize verifying exposure and applying patches.

• Unauthenticated attackers can poison password reset tokens
• Victims may disclose valid reset tokens to attackers
• Full account takeover is possible
• Defenders need to verify exposure and apply patches

Technical summary

The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks that the URL scheme is http/https and never verifies the host against the server's own origin, allowing an attacker to supply an arbitrary host. This allows an unauthenticated attacker to cause the password reset email sent to a victim to contain a reset link pointing at an attacker-controlled server. When the victim follows the link, the valid reset token is disclosed to the attacker, enabling full account takeover. Defenders should prioritize verifying exposure and applying patches.

Defensive priority

Defenders should prioritize verifying exposure of Grav API plugin versions before 1.0.4 and applying the patch or mitigation measures.

Recommended defensive actions

• Verify exposure of Grav API plugin versions before 1.0.4
• Apply patch or mitigation measures
• Monitor for suspicious password reset activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical CVSS score of 9.4 and the affected plugin version. Defenders should verify exposure of Grav API plugin versions before 1.0.4 and review compensating controls for exposed systems. The sanitizeHttpUrl() function only checks that the URL scheme is http/https and never verifies the host against the server's own origin, allowing an attacker to supply an arbitrary host. Evidence is limited to public CVE and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.