CVE-2026-100672 in Grav
Summary
by MITRE • 09/26/2026
The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the admin service is registered on the current route rather than that the visitor is authenticated, and it echoes the JSON and calls exit() during the plugins stage, before the classic Admin plugin would render its login screen. On a site using the classic Admin plugin with Comments enabled (the default), an unauthenticated remote attacker can request /admin/comments/page:<n> (e.g. page:0.001) and retrieve every comment from the last 7 days, including each commenter's email address and the absolute server filesystem path of the data file. Sites running the Grav 2.0 Admin Next stack (admin2 + api) are not affected via this path. The issue is fixed in 1.2.11, which requires an authenticated user with admin.comments or admin.super and removes the absolute filePath from the response.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in the Comments plugin for Grav CMS versions through 1.2.10 represents a critical authentication bypass that exposes sensitive user data to unauthenticated remote attackers. The core technical flaw lies within an administrative handler designed to return comment metadata as JSON, which fails to enforce proper access control mechanisms before transmitting information. Specifically, the code logic relies on a method called isAdmin() to determine authorization status. However, this method is fundamentally flawed because it only verifies whether the admin service has been registered for the current route context rather than validating that the requesting user possesses valid administrative credentials or an active session. This logical error creates a significant gap in security posture, allowing any external entity to interact with endpoints intended exclusively for authorized administrators without providing proof of identity.
The operational impact of this vulnerability is severe due to the specific timing and nature of the data exposure. The vulnerable handler executes during the plugins stage of Grav CMS lifecycle, which occurs before the classic Admin plugin has a chance to render its standard login screen or enforce session checks. Consequently, an attacker can craft requests targeting paths such as /admin/comments/page:<n>, where <n> represents specific page identifiers including non-standard values like 0.001. By doing so, they can retrieve comprehensive comment data from the preceding seven days. This includes not only the content of user comments but also personally identifiable information such as email addresses and internal system details like the absolute server filesystem path of the associated data files. The exposure of file paths is particularly dangerous as it aids in further reconnaissance and potential local file inclusion or traversal attacks, while the leakage of email addresses facilitates targeted phishing campaigns against site users.
This vulnerability specifically affects sites utilizing the classic Admin plugin with Comments enabled, which remains a common configuration for many Grav CMS installations. It does not impact environments running the newer Grav 2.0 Admin Next stack, as that architecture employs different authentication and API handling mechanisms that do suffer from this specific logic flaw. The issue is classified under CWE-862, Missing Authorization, because the application fails to enforce access control policies on a resource that requires privileged access. Furthermore, it aligns with MITRE ATT&CK technique T1078, Valid Accounts, as attackers exploit valid administrative endpoints without possessing legitimate credentials, effectively bypassing authentication controls through logical misconfiguration rather than credential theft or brute force attacks.
To mitigate this vulnerability and prevent further exploitation, administrators must immediately upgrade the Comments plugin to version 1.2.11 or later. This updated release corrects the authorization logic by requiring a fully authenticated user with specific permissions, namely admin.comments or admin.super, before any data is returned. Additionally, the patch removes the absolute file path from the JSON response payload, thereby eliminating one vector for system reconnaissance and reducing the overall attack surface. Organizations should also implement web application firewalls to monitor for anomalous requests targeting administrative endpoints that do not carry valid session tokens, providing an additional layer of defense in depth while ensuring all plugins are kept up to date with security patches released by their maintainers.