{"id":"CVE-2026-117604","kind":"vulnerability","aliases":["CVE-2026-117604"],"related":[],"title":"Grav CMS: debugger flaw lets anonymous visitors read admin passwords","description":"Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.","summary":"Grav CMS versions from 1.7.53.3 before 1.7.53.6 check debugger access in a way that treats requests from the loopback address as trusted. Behind a reverse proxy on the same host, outside requests look like loopback, so an unauthenticated visitor can read /__clockwork/ profiler records, which include administrator plaintext passwords and configuration credentials.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["grav","php","reverse-proxy","runtime","self-hosted"],"not_affected_if":["debugger-disabled","versions-1.7.53.6-or-later"],"how_to_check":"- Check the installed Grav version with `bin/grav version` or the version line in the admin panel; affected range is `1.7.53.3` up to but not including `1.7.53.6`.\n- Confirm whether the debugger is enabled in `user/config/system.yaml` and whether a reverse proxy on the same host forwards public traffic to Grav.\n- Request `/__clockwork/app` from outside the network and see whether profiler data is returned.","fix":"- Upgrade Grav to `1.7.53.6` or later.\n- Disable the debugger in `user/config/system.yaml` until upgraded.\n- Rotate administrator passwords and any configuration credentials stored in the site if the debugger was exposed.","status":"open","published_at":"2026-10-27T15:16:57+00:00","first_seen_at":"2026-10-27T15:32:58+00:00","triaged_at":"2026-10-27T15:33:29+00:00","updated_at":"2026-10-27T15:33:29+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-27T15:33:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Grav to `1.7.53.6` or later.\n- Disable the debugger in `user/config/system.yaml` until upgraded.\n- Rotate administrator passwords and any configuration credentials stored in the site if the debugger was exposed.","reach":"internet","title":"Grav CMS: debugger flaw lets anonymous visitors read admin passwords","impact":"high","summary":"Grav CMS versions from 1.7.53.3 before 1.7.53.6 check debugger access in a way that treats requests from the loopback address as trusted. Behind a reverse proxy on the same host, outside requests look like loopback, so an unauthenticated visitor can read /__clockwork/ profiler records, which include administrator plaintext passwords and configuration credentials.","category":"runtime","nicknames":[],"who_cares":["grav","php","self-hosted","reverse-proxy"],"confidence":0.6,"needs_auth":"no","worst_case":"Anonymous visitors read admin plaintext passwords and config credentials","analyst_note":"Confirm the default debugger state and the exact Clockwork route in the NVD entry and Grav release notes for 1.7.53.6.","how_to_check":"- Check the installed Grav version with `bin/grav version` or the version line in the admin panel; affected range is `1.7.53.3` up to but not including `1.7.53.6`.\n- Confirm whether the debugger is enabled in `user/config/system.yaml` and whether a reverse proxy on the same host forwards public traffic to Grav.\n- Request `/__clockwork/app` from outside the network and see whether profiler data is returned.","needs_analyst":true,"not_affected_if":["debugger-disabled","versions-1.7.53.6-or-later"],"who_is_affected":"Sites running Grav 1.7.53.3 through 1.7.53.5 where the debugger/Clockwork profiler is reachable from the public internet, most often behind a reverse proxy on the same host where the app sees all requests as loopback. Standalone deployments that never forward remote requests to Grav as loopback are less exposed, but the sources do not confirm the exact default debugger setting.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":3385,"output_tokens":774,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117604':13A,16A '-2026':12A,15A '/__clockwork':67B,96C '1.7.53.3':30B,80C '1.7.53.6':32B,82C 'access':35B 'addr':103C 'address':45B 'admin':9A 'administr':72B,123C 'allow':91C 'anonym':6A 'appear':114C 'attack':118C 'author':85C 'behind':48B,105C 'bypass':86C 'check':33B 'cms':2A,27B 'configur':76B,127C 'contain':83C 'credenti':77B,128C 'cve':11A,14A 'data':98C 'debugg':3A,34B,88C 'fallback':104C 'flaw':4A 'grav':1A,17B,26B,78C 'host':25B,55B,109C 'includ':71B,122C 'isdebuggerrequestauthor':89C 'let':5A,117C 'like':59B 'look':58B 'loopback':44B,60B,101C,116C 'outsid':56B 'password':10A,74B,125C 'php':18B 'plaintext':73B,124C 'profil':68B,97C 'proxi':21B,51B,111C 'read':8A,66B,95C,119C 'record':69B,121C 'remot':102C,112C 'request':41B,57B,113C 'revers':20B,50B,110C 'reverse-proxi':19B 'runtim':22B 'same-host':107C 'self':24B 'self-host':23B 'store':120C 'treat':40B 'trust':47B 'unauthent':63B,92C 'version':28B 'via':99C 'visitor':7A,64B,93C 'way':38B","nicknames":[],"mitigations":[],"who_affected":"Sites running Grav 1.7.53.3 through 1.7.53.5 where the debugger/Clockwork profiler is reachable from the public internet, most often behind a reverse proxy on the same host where the app sees all requests as loopback. Standalone deployments that never forward remote requests to Grav as loopback are less exposed, but the sources do not confirm the exact default debugger setting.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T15:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117604","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117604","severity":null,"published_at":"2026-10-27T15:16:57+00:00","modified_at":"2026-10-27T15:16:57+00:00","first_seen_at":"2026-10-27T15:32:58+00:00","fetched_at":"2026-10-27T15:32:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}