CVE-2026-65895: Grav API Plugin before 1.0.10 Broken Access Control
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav API Pluginto a version that resolves this vulnerability.Fixed in 1.0.10 - Configuration
Ensure site-wide rate limiting is enabled; prevent authenticated users with api.config.write from disabling it (Grav API Plugin versions before 1.0.10 have broken access control for write to security-critical configuration scopes).
Grav API Plugin rate limiting site-wide (enable/disable) = enable - Configuration
Reconfigure CORS to exclude attacker-controlled origins and ensure credentials are not enabled for untrusted origins (Grav API Plugin versions before 1.0.10 can be used to reconfigure CORS settings due to broken access control).
Grav API Plugin CORS policy (origins and credentials) = Restrict origins to trusted origins and disable credentials for attacker-controlled origins
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65895?
CVE-2026-65895 has a severity rating of 8.5, classified as high.
How do I fix CVE-2026-65895?
To mitigate CVE-2026-65895, upgrade to Grav API Plugin version 1.0.10 or later.
What is the risk associated with CVE-2026-65895?
CVE-2026-65895 carries a risk score of 55, indicating significant potential impact.
What type of vulnerability is CVE-2026-65895?
CVE-2026-65895 is a broken access control vulnerability that allows unauthorized modification of crucial configuration settings.
Who is affected by CVE-2026-65895?
Authenticated users with the api.config.write privilege on Grav API Plugin versions before 1.0.10 are affected by CVE-2026-65895.