{"id":"CVE-2026-117604","title":"Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback","summary":"Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-ho…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-200"],"vendor":"getgrav","product":"grav","affected":["grav >= 1.7.53.3 < 1.7.53.6"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T14:39:10.858Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-117604","references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-xprx-c7jf-cp6g","label":"GitHub Security Advisory (GHSA-xprx-c7jf-cp6g)"},{"url":"https://github.com/getgrav/grav/commit/4d9fca043f990a818d65cea61c928203b9e19641"},{"url":"https://github.com/getgrav/grav/releases/tag/1.7.53.6","label":"grav 1.7.53.6 Release Notes"},{"url":"https://www.vulncheck.com/advisories/grav-from-1.7.53.3-before-1.7.53.6-clockwork-profiler-authorization-bypass-via-loopback-fallback","label":"VulnCheck Advisory: Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback"}],"tags":["cve.org"],"ingestedAt":"2026-10-27T16:11:59.459Z","slug":"CVE-2026-117604","body":"## Overview\n\nGrav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.\n\n## Affected\n\n- `grav >= 1.7.53.3 < 1.7.53.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}