Cpe:2.3:a:getgrav:grav:1.7.53.5:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3agetgravgrav1.7.53.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 15:51:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGrav: Authorization bypass in Debugger component (CVE-2026-117604)https://feed.craftedsignal.io/briefs/2026-10-grav-debugger-auth-bypass/Tue, 27 Oct 2026 15:51:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-grav-debugger-auth-bypass/An authorization bypass vulnerability in the Grav CMS Debugger component allows unauthenticated remote attackers to access sensitive profiler data when the application is deployed behind a reverse proxy.Grav versions 1.7.53.3 through 1.7.53.5 contain an authorization bypass vulnerability within the Debugger::isDebuggerRequestAuthorized() method. The vulnerability arises from an insecure fallback mechanism that trusts the REMOTE_ADDR variable. When the application is deployed behind a reverse proxy, requests may be incorrectly identified as originating from the local loopback, bypassing access controls for the /__clockwork/ endpoint.

Impact

Unauthenticated remote attackers can access the /__clockwork/ profiler data. This exposure may include sensitive configuration credentials and administrator plaintext passwords stored within the profiler records.

Recommendation

  • Upgrade Grav to version 1.7.53.6 or later immediately.
  • If an immediate upgrade is not possible, disable the Debugger component or restrict access to the /__clockwork/ path via reverse proxy configuration (e.g., Nginx or Apache) to ensure only authorized administrative IPs are permitted.
  • Audit logs for suspicious GET requests to the /__clockwork/ directory from external IP addresses to identify potential prior exploitation.
]]>highadvisory