Skip to content
Threat Feed
Subscribe
high advisory

Grav: Authorization bypass in Debugger component (CVE-2026-117604)

An authorization bypass vulnerability in the Grav CMS Debugger component allows unauthenticated remote attackers to access sensitive profiler data when the application is deployed behind a reverse proxy.

CVE search metadata

CVE search record: CVE-2026-117604. Severity: high. CVSS: 7.5. KEV: no. Product: Grav (1.7.53.3 to 1.7.53.5). Brief: Grav: Authorization bypass in Debugger component (CVE-2026-117604). Brief link: https://feed.craftedsignal.io/briefs/2026-10-grav-debugger-auth-bypass/

Triage facts

Revision 1
Applicability
Grav (1.7.53.3 to 1.7.53.5)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 27, 15:51 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

Grav versions 1.7.53.3 through 1.7.53.5 contain an authorization bypass vulnerability within the Debugger::isDebuggerRequestAuthorized() method. The vulnerability arises from an insecure fallback mechanism that trusts the REMOTE_ADDR variable. When the application is deployed behind a reverse proxy, requests may be incorrectly identified as originating from the local loopback, bypassing access controls for the /__clockwork/ endpoint.

Impact

Unauthenticated remote attackers can access the /__clockwork/ profiler data. This exposure may include sensitive configuration credentials and administrator plaintext passwords stored within the profiler records.

Recommendation

  • Upgrade Grav to version 1.7.53.6 or later immediately.
  • If an immediate upgrade is not possible, disable the Debugger component or restrict access to the /__clockwork/ path via reverse proxy configuration (e.g., Nginx or Apache) to ensure only authorized administrative IPs are permitted.
  • Audit logs for suspicious GET requests to the /__clockwork/ directory from external IP addresses to identify potential prior exploitation.

Immediate actions

Patch Grav to version 1.7.53.6

IT Operations 24h

Threat Hunt

Identify GET requests to /__clockwork/ from external IP addresses

T1552.001 high high confidence hunt now

Data: Web server logs (cs-uri-stem, c-ip)

Mitigations

Restrict /__clockwork/ path access at the reverse proxy level

immediate IT Operations

CVE-2026-117604

Detection coverage 1

Detect CVE-2026-117604 Exploitation Attempt - Access to Clockwork Profiler

high

Detects unauthorized access attempts to the Clockwork profiler endpoint, which is a indicator of exploitation for CVE-2026-117604

sigma tactics: credential_access, initial_access techniques: T1190, T1552.001 sources: webserver

Detection queries are available on the platform. Get full rules →