CVE-2026-117604 Details
Description
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
A vulnerability in Grav versions 1.7.53.3 prior to 1.7.53.6 allows authorization bypass in the Debugger component. The issue arises in the 'isDebuggerRequestAuthorized()' method, where unauthenticated visitors can access '/__clockwork/' profiler data. This exploitation is made possible through a loopback REMOTE_ADDR fallback, particularly when the site is behind a same-host reverse proxy. In such cases, remote requests are treated as local, enabling attackers to retrieve stored records that may include plaintext passwords and sensitive configuration details.
Users can upgrade to Grav version 1.7.53.6 or later, where this vulnerability has been patched. Instructions for downloading the latest version are available on the Grav GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav | >= 1.7.53.3, < 1.7.53.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |