grav up to 1.10.x Admin Plugin /admin/forgot response discrepancy

Summaryinfo

A vulnerability classified as problematic has been found in grav up to 1.10.x. Affected by this vulnerability is an unknown functionality of the file /admin/forgot of the component Admin Plugin. Performing a manipulation results in response discrepancy. This vulnerability is reported as CVE-2025-66307. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in grav up to 1.10.x. This affects some unknown processing of the file /admin/forgot of the component Admin Plugin. The manipulation with an unknown input leads to a response discrepancy vulnerability. CWE is classifying the issue as CWE-204. The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. This is going to have an impact on confidentiality. The summary by CVE is:

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering. This vulnerability is fixed in 1.11.0-beta.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-66307 since 11/27/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 1.11.0-beta.1 eliminates this vulnerability. Applying the patch 99f653296504f1d6408510dd2f6f20a45a26f9b0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-200103). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• grav

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion