CVE-2026-109320
Received Received - Intake

Improper Session Validation in Grav API Plugin

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109320
EUVD
EUVD-2026-97622

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-api 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Grav API plugin before version 1.0.36 has a flaw where disabled user accounts can still access API functions. This happens because the SessionAuthenticator does not check if an account is disabled when validating sessions. Disabled users can exploit existing authorized sessions to make API calls until those sessions expire.

Detection Guidance

Check Grav plugin versions with 'composer show grav-plugin-api' or inspect plugin files for version in /user/plugins/api. Review active sessions for disabled accounts via Grav admin panel or database session tables. Monitor API logs for unusual activity from disabled users.

Impact Analysis

If you use the Grav API plugin, disabled accounts might retain unauthorized API access. This could allow former employees or revoked users to interact with your system, potentially leaking data or performing actions they shouldn't. The risk depends on whether you rely on session revocation for security.

Compliance Impact

This vulnerability could violate compliance requirements that mandate timely revocation of access for disabled or terminated accounts, such as GDPR's data protection principles or HIPAA's access control rules. Unauthorized API access may lead to data breaches or unauthorized processing.

Mitigation Strategies

Upgrade grav-plugin-api to version 1.0.36 or later immediately. Review and disable all sessions for previously disabled accounts. Implement session expiration policies and monitor API access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109320. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart