CVE-2026-117604
CVE-2026-117604 · Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
CVSS 8.7 · High · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
grav
- Versions
- ≥ 1.7.53.3, < 1.7.53.6: Affected (custom)
- 1.7.53.6: Not affected (custom)
Update to 1.7.53.6
Original sources
- https://github.com/getgrav/grav/security/advisories/GHSA-xprx-c7jf-cp6g
- https://github.com/getgrav/grav/commit/4d9fca043f990a818d65cea61c928203b9e19641
- https://github.com/getgrav/grav/releases/tag/1.7.53.6
- https://www.vulncheck.com/advisories/grav-from-1.7.53.3-before-1.7.53.6-clockwork-profiler-authorization-bypass-via-loopback-fallback
- https://nvd.nist.gov/vuln/detail/CVE-2026-117604