---
id: CVE-2026-109320
title: >-
  The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper
  session validation vulnerability that allows disabled accounts to keep API
  access, because SessionAuthenticator does not enforce account state
summary: >-
  The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper
  session validation vulnerability that allows disabled accounts to keep API
  access, because SessionAuthenticator does not enforce account state. Disabled
  users can r…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-613
published: '2026-10-12'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T19:18:32.350'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109320'
references:
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-7qfj-82q8-frw6'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/grav-api-plugin-before-1.0.36-disabled-account-session-access-bypass
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00245
epssPercentile: 0.14598
ingestedAt: '2026-10-12T18:00:08.201Z'
---

## Overview

The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.