Veille CVE

Semaine du 12 octobre au 18 octobre 2026

2 CVE

Critique 0 Élevée 1 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « getgrav grav-plugin-api » ✕
  1. CVE-2026-109320 5.4 Moyenne

    getgrav grav-plugin-api

    The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.

  2. CVE-2026-109317 7.2 Élevée

    getgrav grav-plugin-api

    Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.