CVE-2026-109320: Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass

Q: Who can exploit this issue?

An account that has been disabled can exploit it if it still has an already authorized browser session or remember-me session. The issue applies to API endpoint access through those existing sessions.

Q: Does disabling a user immediately revoke their API access?

No. In affected versions, SessionAuthenticator does not enforce the account's disabled state, so a disabled user can continue using an existing authorized session until it expires.

Q: What should be done if the plugin cannot be updated immediately?

Ensure sessions held by disabled accounts expire or are otherwise invalidated, since the bypass depends on reuse of an existing authorized browser or remember-me session.

Q: How can we determine whether we are affected?

Check whether the Grav API plugin version is earlier than 1.0.36 and whether disabled accounts may retain authorized browser or remember-me sessions. Review API activity from disabled accounts while previously issued sessions remain valid.

Published Oct 12, 2026

Updated

The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.

Affected Software

1 affected component

Grav Grav API Plugin<1.0.36

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade grav-plugin-api to a version that resolves this vulnerability.
Fixed in 1.0.36

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An account that has been disabled can exploit it if it still has an already authorized browser session or remember-me session. The issue applies to API endpoint access through those existing sessions.

Does disabling a user immediately revoke their API access?

No. In affected versions, SessionAuthenticator does not enforce the account's disabled state, so a disabled user can continue using an existing authorized session until it expires.

What should be done if the plugin cannot be updated immediately?

Ensure sessions held by disabled accounts expire or are otherwise invalidated, since the bypass depends on reuse of an existing authorized browser or remember-me session.

How can we determine whether we are affected?

Check whether the Grav API plugin version is earlier than 1.0.36 and whether disabled accounts may retain authorized browser or remember-me sessions. Review API activity from disabled accounts while previously issued sessions remain valid.

CVE-2026-109320: Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Does disabling a user immediately revoke their API access?

What should be done if the plugin cannot be updated immediately?

How can we determine whether we are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Does disabling a user immediately revoke their API access?

What should be done if the plugin cannot be updated immediately?

How can we determine whether we are affected?