Medium severity · published Oct 12, 2026
CVE-2026-109320
Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav-plugin-api · getgrav
before 1.0.36 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109320
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109320
vendor-advisory
https://github.com/getgrav/grav/security/advisories/GHSA-7qfj-82q8-frw6
third-party-advisory
https://www.vulncheck.com/advisories/grav-api-plugin-before-1.0.36-disabled-account-session-access-bypass
More from grav-plugin-api
9.8
CVE-2026-112779
Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
9.4
CVE-2026-62668
Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols
8.8
CVE-2026-62666
Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super
8.8
CVE-2026-72833
Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys
8.8
CVE-2026-42843
grav-plugin-api: Grav API Privilege Escalation to Super Admin