CVE-2026-62387: Grav API Plugin CORS CSRF Vulnerability

CVE-2026-62387 Overview

CVE-2026-62387 is a Cross-Origin Resource Sharing (CORS) misconfiguration in the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.0-rc.16. The plugin shipped with Access-Control-Allow-Origin: * as its default header on all responses, including authenticated endpoints and preflight OPTIONS responses. Because the plugin accepts credentials through the Authorization and X-API-Token headers set programmatically by JavaScript, any malicious website can issue authenticated cross-origin requests once an attacker obtains a valid token. The issue is fixed in 1.0.0-rc.16 and classified under [CWE-942] Permissive Cross-domain Policy with Untrusted Domains.

Critical Impact
Attackers with a leaked API token can read sensitive Grav content and perform write operations as the token owner from any origin.

Affected Products

Grav API plugin (getgrav/grav-plugin-api) versions prior to 1.0.0-rc.16
Grav CMS instances that deploy the API plugin with default CORS settings
Any Grav deployment issuing bearer tokens or X-API-Token values consumed by browser clients

Discovery Timeline

2026-07-17 - CVE-2026-62387 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-62387

Vulnerability Analysis

The Grav API plugin returned Access-Control-Allow-Origin: * on every response, including responses for authenticated routes and preflight OPTIONS requests. Under normal CORS semantics, a wildcard origin blocks credentialed requests carried via cookies. The Grav plugin sidesteps that mitigation by expecting clients to attach credentials through the Authorization and X-API-Token request headers, which JavaScript sets programmatically rather than the browser attaching automatically.

With the wildcard origin allowed and credentials transported in custom headers, a malicious page hosted anywhere on the internet can construct authenticated fetch or XMLHttpRequest calls to the target Grav instance. If the attacker has previously captured a valid token, the browser transmits it, the API responds, and the malicious script reads the response body. The impact extends beyond information disclosure to full write operations, since the plugin exposes state-changing endpoints under the same permissive header.

Root Cause

The root cause is an insecure default in the plugin's response handling. Wildcard CORS is treated as safe when credentials rely on cookies, but the plugin authenticates through custom headers, breaking that assumption. The design conflated public API exposure with authenticated access control.

Attack Vector

Exploitation requires prior possession of a valid access token. Tokens can be harvested through log leakage, Referer headers, browser history, network capture, or shared debugging output. Once an attacker holds a token, they lure a victim or use their own browser session to load a page that issues cross-origin fetch requests carrying the token in the Authorization or X-API-Token header. Full technical details are available in the GitHub Security Advisory and the VulnCheck Advisory on Grav.

Detection Methods for CVE-2026-62387

Indicators of Compromise

Grav API responses that include Access-Control-Allow-Origin: * alongside Authorization or X-API-Token request headers
Unexpected OPTIONS preflight requests to Grav API endpoints originating from unfamiliar Origin header values
Successful authenticated API calls whose Referer or Origin does not match the site's own frontend
Token usage patterns showing the same token active across geographically or behaviorally distinct clients

Detection Strategies

Inspect running Grav deployments to identify plugin versions below 1.0.0-rc.16
Review web server and reverse proxy logs for OPTIONS requests followed by authenticated GET/POST calls from third-party origins
Alert on any Grav API response where the CORS policy is wildcard while an Authorization header is present in the request

Monitoring Recommendations

Enable centralized logging of Grav API request/response headers, including Origin, Referer, and CORS headers
Correlate API token identifiers across sessions to spot token reuse from unexpected sources
Baseline expected client origins and generate alerts on deviations

How to Mitigate CVE-2026-62387

Immediate Actions Required

Upgrade getgrav/grav-plugin-api to version 1.0.0-rc.16 or later on every Grav instance
Rotate all API tokens issued before the upgrade, treating previously leaked tokens as compromised
Audit historical logs, browser history exports, and Referer sinks for exposed tokens

Patch Information

The maintainers fixed the issue in Grav API plugin 1.0.0-rc.16 by restricting the CORS policy so that Access-Control-Allow-Origin: * is no longer returned on authenticated endpoints or preflight responses. Refer to the GitHub Security Advisory for release notes and commit references.

Workarounds

Terminate CORS at a reverse proxy and enforce an explicit allowlist of trusted origins for Grav API paths
Strip or override the plugin's Access-Control-Allow-Origin header before responses leave the server
Restrict API plugin access by IP or network segmentation until patching is complete
Shorten token lifetimes and scope tokens to the minimum permissions required

bash

# Example nginx override enforcing an allowlist for Grav API responses
location /api/ {
    set $cors_origin "";
    if ($http_origin = "https://admin.example.com") {
        set $cors_origin $http_origin;
    }

    proxy_hide_header Access-Control-Allow-Origin;
    add_header Access-Control-Allow-Origin $cors_origin always;
    add_header Vary Origin always;

    proxy_pass http://grav_backend;
}