CVE-2026-62387

The record

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default CORS configuration on all responses, including authenticated endpoints and preflight (OPTIONS) responses. Because the plugin accepts credentials via the Authorization and X-API-Token headers (set programmatically by JavaScript rather than via cookies), an attacker who obtains a valid access token (e.g., via log leakage, Referer headers, browser history, or network capture) can issue fully authenticated cross-origin requests from any malicious website to read sensitive data and perform write operations as the token's user. Fixed in 1.0.0-rc.16.

Affected packages

Related vulnerabilities

• CVE-2026-62863 MoLing is a computer-use and browser-use based MCP server. CWE-942
• CVE-2026-119285 Fiber is an Express inspired web framework written in Go. CWE-942
• CVE-2026-110737 The push endpoint of a Vaadin application that uses server push reflects the request… CWE-942
• CVE-2026-116748 Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in… CWE-942
• CVE-2026-115917 vLLM is an inference and serving engine for large language models. CWE-942
• CVE-2026-107858 Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy… CWE-942
• CVE-2026-3303 IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow… CWE-942
• CVE-2026-85313 Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty… CWE-942