This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering. This vulnerability is fixed in 1.11.0-beta.1.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Getgrav |
|
No data.
References
History
Wed, 03 Dec 2025 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:getgrav:grav-plugin-admin:*:*:*:*:*:*:*:* |
Tue, 02 Dec 2025 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 02 Dec 2025 12:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Getgrav
Getgrav grav Getgrav grav-plugin-admin |
|
| Vendors & Products |
Getgrav
Getgrav grav Getgrav grav-plugin-admin |
Mon, 01 Dec 2025 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering. This vulnerability is fixed in 1.8.0-beta.27. | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering. This vulnerability is fixed in 1.11.0-beta.1. |
| Title | Grav vulnerable to User Enumeration & Email Disclosure | Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure |
| References |
|
Mon, 01 Dec 2025 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering. This vulnerability is fixed in 1.8.0-beta.27. | |
| Title | Grav vulnerable to User Enumeration & Email Disclosure | |
| Weaknesses | CWE-204 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2025-12-01T21:53:43.510Z
Updated: 2025-12-02T20:07:53.150Z
Reserved: 2025-11-26T23:11:46.396Z
Link: CVE-2025-66307
Vulnrichment
Updated: 2025-12-02T20:07:42.654Z
NVD
Status : Analyzed
Published: 2025-12-01T22:15:50.570
Modified: 2025-12-03T21:58:18.367
Link: CVE-2025-66307
Redhat
No data.