---
id: CVE-2026-109320
title: >-
  The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper
  session validation vulnerability that allows disabled accounts to keep API
  access, because SessionAuthenticator does not enforce account state
summary: >-
  The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper
  session validation vulnerability that allows disabled accounts to keep API
  access, because SessionAuthenticator does not enforce account state. Disabled
  users can r…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-613
vendor: getgrav
product: grav-plugin-api
affected:
  - grav-plugin-api < 1.0.36
published: '2026-10-12'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:21:14.417'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109320'
references:
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-7qfj-82q8-frw6'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/grav-api-plugin-before-1.0.36-disabled-account-session-access-bypass
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00245
epssPercentile: 0.15667
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T18:11:47.441705Z'
ingestedAt: '2026-10-12T18:00:08.201Z'
---

## Overview

The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.