CVE-2026-117604High· 7.5▾ TwilightGrav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-ho…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
grav >= 1.7.53.3 < 1.7.53.6Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114657Medium· 5.7Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri
CVE-2026-112781Medium· 6.5Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives
CVE-2026-109325High· 7.5Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values
CVE-2026-109315Medium· 6.5Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token
CVE-2026-100668Medium· 6.5Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape
CVE-2026-100671High· 8.0Grav is a flat-file CMS