CVE-2026-61452 getgrav CVE debrief

Who should care

Defenders responsible for Grav API plugin deployments, security teams monitoring API access, and administrators of systems using the plugin should assess exposure and implement compensating controls.

Why it matters

CVE-2026-61452 is a medium-severity vulnerability in the Grav API plugin. The plugin issues JWT access tokens without a unique identifier, making them irrevocable. Attackers who obtain these tokens can maintain API access until they expire, regardless of user actions like logout or password changes. Defenders should prioritize verifying exposure, checking for unauthorized access tokens, and implementing compensating controls to limit API access.

• Maintaining unauthorized API access until token expiration
• Potential for lateral movement within systems using the plugin
• Need for verification of exposure and compensating controls
• Prioritization of updating to Grav API plugin version 2.0.4 or later

Technical summary

The Grav API plugin (getgrav/grav-plugin-api) before version 2.0.4 contains an improper session invalidation vulnerability. JWT access tokens are issued without a jti (JWT ID) claim, making them irrevocable server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password change, new token issuance, or account disablement. This vulnerability allows attackers with stolen access tokens to maintain full API access until the tokens naturally expire. Defenders should focus on verifying exposure of affected plugin versions, checking for unauthorized access tokens, and implementing compensating controls to limit API access. The vulnerability's impact

Defensive priority

Defenders should prioritize verifying exposure of Grav API plugin versions before 2.0.4, checking for unauthorized access tokens, and implementing compensating controls to limit API access.

Recommended defensive actions

• Verify exposure of Grav API plugin versions before 2.0.4
• Check for unauthorized access tokens
• Implement compensating controls to limit API access
• Monitor for suspicious API activity
• Update to Grav API plugin version 2.0.4 or later

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the corpus lacks specific information on affected versions, exploitation, and remediation. To verify exposure, defenders should check for Grav API plugin versions before 2.0.4, review system logs for suspicious API activity, and implement compensating controls such as monitoring for unauthorized access tokens and limiting API access. The CVE Program record (CVE-2026-61452) and NVD detail page offer source-specific vulnerability assessments. Additional source  

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.