CVE-2026-62386

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq
https://www.vulncheck.com/advisories/grav-rc-16-authentication-bypass-via-token-url-parameter
https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El plugin de la API de Grav (getgrav/grav-plugin-api) anterior a la 1.0.0-rc.16 acepta tokens de acceso JWT a través del parámetro de consulta URL ?token= en cada ruta de la API (alternativa de JwtAuthenticator::extractBearerToken). Debido a que los tokens están incrustados en las URL, se registran textualmente en los registros de acceso del servidor web, se filtran a través del encabezado Referer, se almacenan en el historial del navegador y son capturados por los registros de proxy ascendente y CDN, exponiendo tokens de acceso de administrador válidos. Un token filtrado otorga acceso no autorizado a la API, incluyendo la lectura de la configuración y los datos de usuario, la creación de cuentas de administrador, la modificación de la configuración del sistema y la eliminación de páginas.

Information

Published : 2026-07-17 02:18

Updated : 2026-10-24 20:10

NVD link : CVE-2026-62386

Mitre link : CVE-2026-62386

CVE.ORG link : CVE-2026-62386

JSON object : View

Products Affected

No product.

CWE

CWE-598

Use of HTTP Request With Sensitive Query String

{"id": "CVE-2026-62386", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62386", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T19:21:05.635810Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/getgrav/grav", "vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.0-rc.16", "versionType": "semver"}, {"status": "unaffected", "version": "1.0.0-rc.16", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-17T02:18:11.903", "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/grav-rc-16-authentication-bypass-via-token-url-parameter", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-598"}]}], "descriptions": [{"lang": "en", "value": "The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages."}, {"lang": "es", "value": "El plugin de la API de Grav (getgrav/grav-plugin-api) anterior a la 1.0.0-rc.16 acepta tokens de acceso JWT a trav\u00e9s del par\u00e1metro de consulta URL ?token= en cada ruta de la API (alternativa de JwtAuthenticator::extractBearerToken). Debido a que los tokens est\u00e1n incrustados en las URL, se registran textualmente en los registros de acceso del servidor web, se filtran a trav\u00e9s del encabezado Referer, se almacenan en el historial del navegador y son capturados por los registros de proxy ascendente y CDN, exponiendo tokens de acceso de administrador v\u00e1lidos. Un token filtrado otorga acceso no autorizado a la API, incluyendo la lectura de la configuraci\u00f3n y los datos de usuario, la creaci\u00f3n de cuentas de administrador, la modificaci\u00f3n de la configuraci\u00f3n del sistema y la eliminaci\u00f3n de p\u00e1ginas."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "disclosure@vulncheck.com"}