CVE-2026-65895 getgrav CVE debrief

Who should care

Administrators and users of Grav API Plugin, especially those with 'api.config.write' privileges, should be aware of this vulnerability and take immediate action to update or mitigate it.

Technical summary

The Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes. This allows authenticated users with 'api.config.write' privilege to modify rate limiting and CORS settings. Attackers can exploit this to disable rate limiting site-wide, enabling credential brute-forcing attacks, and reconfigure CORS policies to include attacker-controlled origins with credentials enabled. The vulnerability has a CVSS score of 8.2 and is classified as HIGH.

Defensive priority

Authenticated users with limited privileges can modify critical settings, allowing potential credential brute-forcing attacks and CORS policy changes.

Recommended defensive actions

• Review and restrict 'api.config.write' privileges to only necessary users
• Implement additional monitoring for changes to rate limiting and CORS settings
• Update Grav API Plugin to version 1.0.10 or later
• Conduct regular inventory checks for plugin versions and user privileges
• Consider compensating controls for credential brute-forcing attacks

Evidence notes

The CVE-2026-65895 record indicates that Grav API Plugin versions before 1.0.10 are vulnerable due to insufficient access restrictions on security-critical plugin configuration scopes. Authenticated users with the 'api.config.write' privilege can modify rate limiting and CORS settings. This could allow attackers to disable rate limiting site-wide, enabling credential brute-forcing attacks, and reconfigure CORS policies to include attacker-controlled origins with credentials enabled. The CVSS score is 8.2, classified as HIGH.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.