Live › vulnerability › CVE-2026-117604
Go to dashboardGrav CMS versions from 1.7.53.3 before 1.7.53.6 check debugger access in a way that treats requests from the loopback address as trusted. Behind a reverse proxy on the same host, outside requests look like loopback, so an unauthenticated visitor can read /__clockwork/ profiler records, which include administrator plaintext passwords and configuration credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:32 UTC. All times on this page are UTC.
Sites running Grav 1.7.53.3 through 1.7.53.5 where the debugger/Clockwork profiler is reachable from the public internet, most often behind a reverse proxy on the same host where the app sees all requests as loopback. Standalone deployments that never forward remote requests to Grav as loopback are less exposed, but the sources do not confirm the exact default debugger setting.
No product ranges from the sources yet.
bin/grav version or the version line in the admin panel; affected range is 1.7.53.3 up to but not including 1.7.53.6.user/config/system.yaml and whether a reverse proxy on the same host forwards public traffic to Grav./__clockwork/app from outside the network and see whether profiler data is returned.1.7.53.6 or later.user/config/system.yaml until upgraded.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-117604")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.