7.5Alta
CVE-2026-117604Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback
Descripción
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
Debilidad (CWE):
CWE-200
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
Referencias y parches
- GitHub Security Advisory (GHSA-xprx-c7jf-cp6g) vendor-advisory
- https://github.com/getgrav/grav/commit/4d9fca043f990a818d65cea61c928203b9e19641 patch
- grav 1.7.53.6 Release Notes release-notes
- VulnCheck Advisory: Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback third-party-advisory