Authentication Bypass in Grav CMS Comments Plugin

The Comments plugin for Grav CMS (getgrav/grav-plugin-comments) through version 1.2.10 contains a critical authentication bypass vulnerability (CVE-2026-100672). The plugin registers an admin handler that fails to verify the authentication state of the requester, relying instead on an incorrect check (isAdmin()) that only validates the presence of the admin service on the requested route. This flaw allows an unauthenticated remote attacker to query the /admin/comments/page: endpoints. Because this handler executes during the plugin stage before the Admin plugin initiates its standard login procedures, attackers can bypass authentication entirely. Successful exploitation results in the unauthorized disclosure of sensitive comment metadata, including commenter email addresses and absolute server filesystem paths, which can facilitate further reconnaissance against the hosting environment. This issue does not affect the Grav 2.0 Admin Next stack.

Impact

The vulnerability leads to the unauthorized exfiltration of site comment data, exposing PII such as email addresses and revealing internal server directory structures. This information leak aids attackers in conducting targeted phishing or mapping the backend filesystem to identify further attack surfaces.

Recommendation

• Upgrade the Grav CMS Comments plugin to version 1.2.11 or later to remediate CVE-2026-100672.
• Audit logs for suspicious GET requests to the /admin/comments/ path from unauthenticated sources or anomalous IPs.
• Restrict access to the /admin/ directory at the web server level (e.g., using Nginx or Apache allowlisting) if the update cannot be applied immediately.