CVE-2026-63407: Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: and permissive OPTIONS responses for authenticated /api/v1 endpoints. JavaScript from any origin can submit an attacker-obtained JWT through the Authorization or X-API-Token header, read the authenticated response, and perform write operations with the token owner's privileges, enabling data exfiltration and account modification. This issue is fixed in version 1.0.0-rc.16.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav API Pluginto a version that resolves this vulnerability.Fixed in 1.0.0-rc.16
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the Grav API Plugin before version 1.0.0-rc.16 are affected where authenticated /api/v1 endpoints are available. The vulnerable middleware returns a wildcard Access-Control-Allow-Origin value and permissive OPTIONS responses for those endpoints.
What does an attacker need to exploit this issue?
An attacker needs an authenticated JWT or X-API-Token obtained from a user. They can then use JavaScript hosted on any origin to send that token in an Authorization or X-API-Token header, read authenticated API responses, and perform actions with that token owner's privileges.
What should be done if the plugin cannot be upgraded immediately?
The provided information identifies version 1.0.0-rc.16 as the fix but does not specify a workaround. Until upgrading, treat JWTs and API tokens for affected API endpoints as sensitive to cross-origin use and limit exposure of authenticated /api/v1 access where possible.