CVE-2026-65895 — Grav API Plugin before 1.0.10 Broken Access Control
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privile…
Published: 2026-07-23 · CVSS: 8.2 · CVSS 4.0
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7