CVE-2026-63407 (CVSS 8.2)

Description

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticated /api/v1 endpoints. JavaScript from any origin can submit an attacker-obtained JWT through the Authorization or X-API-Token header, read the authenticated response, and perform write operations with the token owner's privileges, enabling data exfiltration and account modification. This issue is fixed in version 1.0.0-rc.16.

Is your site exposed to CVE-2026-63407?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

EPSS — Exploit Prediction

0.0027

Probability of exploitation

0.19%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-942 CWE-942

References

Other References

https://github.com/getgrav/grav-plugin-api/commit/56ae2ca3bf36c8299a4b3d376c6a20e8c0ed5ba9 https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.0-rc.16 https://github.com/getgrav/grav/security/advisories/GHSA-93px-98wh-6fj2 https://github.com/getgrav/grav/security/advisories/GHSA-93px-98wh-6fj2

Frequently Asked Questions

What is CVE-2026-63407? +

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: * and permissive OPTIONS responses for authenticated /api/v1 endpoints. JavaScript from any origin can submit an attacker-obtained JWT through the Authorization or X-API-Token header, read the authenticated response, and perform write operations with the token owner's privileges, enabling data exfiltration and account modification. This issue is fixed in version 1.0.0-rc.16. It has a CVSS v3.1 base score of 8.2 (HIGH).

How severe is CVE-2026-63407? +

CVE-2026-63407 has a CVSS v3.1 score of 8.2 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0027, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-63407? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-57755

claude-code-router is a powerful tool to route Claude Code requests to different models and customize any request. Due to improper …

CVE-2026-44895

GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships …

CVE-2024-49763

PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensitive information from PlexRipper …

CVE-2026-12962

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's …

CVE-2020-36851

Rob -- W / cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to …

CVE-2024-10315

In Gliffy Online an insecure configuration was discovered in versions before 4.14.0-6. Reported by Alpha Inferno PVT LTD.

CVE-2026-63407