CVE-2026-117604 in Grav
Zusammenfassung
von MITRE • 27.10.2026
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.