Medium severity5.4NVD Advisory· Published Oct 12, 2026

CVE-2026-109320

Description

The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Getgrav/Grav Plugin APIllm-fuzzy
Range: <1.0.36
Getgrav/Gravllm-fuzzy
Range: <1.0.36

Patches

Vulnerability mechanics

References

github.com/getgrav/grav/security/advisories/GHSA-7qfj-82q8-frw6nvd
www.vulncheck.com/advisories/grav-api-plugin-before-1.0.36-disabled-account-session-access-bypassnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000