CVE-2026-100672 Details
Description
The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the admin service is registered on the current route rather than that the visitor is authenticated, and it echoes the JSON and calls exit() during the plugins stage, before the classic Admin plugin would render its login screen. On a site using the classic Admin plugin with Comments enabled (the default), an unauthenticated remote attacker can request /admin/comments/page:<n> (e.g. page:0.001) and retrieve every comment from the last 7 days, including each commenter's email address and the absolute server filesystem path of the data file. Sites running the Grav 2.0 Admin Next stack (admin2 + api) are not affected via this path. The issue is fixed in 1.2.11, which requires an authenticated user with admin.comments or admin.super and removes the absolute filePath from the response.
A vulnerability exists in the Comments plugin for Grav CMS, affecting versions through 1.2.10. The plugin registers an admin handler that exposes comment data as JSON without requiring authentication. This handler, which is active when the classic Admin plugin is installed and Comments is enabled, can be exploited by unauthenticated remote attackers to access recent comments, including the commenter's email addresses and the absolute server filesystem paths of the data files. The vulnerability arises because the admin service is registered on the current route without verifying if the visitor is authenticated, allowing anonymous users to bypass the trust scope and access admin-only data. Sites using the Grav 2.0 Admin Next stack are not affected via this path.
Users are advised to upgrade to Comments plugin version 1.2.11, which requires authentication for users with 'admin.comments' or 'admin.super' privileges before accessing comment data. The absolute filepath has also been removed from the response. For those unable to upgrade immediately, the Comments plugin should be disabled.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-3cq9-f4pf-hq59 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/grav-plugin-comments-before-1.2.11-unauthenticated-information-disclosure | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getgrav/grav-plugin-comments | <= 1.2.10 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | New CVE Received | [email protected] |