CVE-2026-117604
CVE-2026-117604 · Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
CVSS 8.7 · Hoch · EPSS 0,3% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
grav
- Softwareversionen
- ≥ 1.7.53.3, < 1.7.53.6: Betroffen (custom)
- 1.7.53.6: Nicht betroffen (custom)
Auf 1.7.53.6 aktualisieren
Originalquellen
- https://github.com/getgrav/grav/security/advisories/GHSA-xprx-c7jf-cp6g
- https://github.com/getgrav/grav/commit/4d9fca043f990a818d65cea61c928203b9e19641
- https://github.com/getgrav/grav/releases/tag/1.7.53.6
- https://www.vulncheck.com/advisories/grav-from-1.7.53.3-before-1.7.53.6-clockwork-profiler-authorization-bypass-via-loopback-fallback
- https://nvd.nist.gov/vuln/detail/CVE-2026-117604