This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering. This vulnerability is fixed in 1.11.0-beta.1.
References
| Link | Resource |
|---|---|
| https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0 | Patch |
| https://github.com/getgrav/grav/security/advisories/GHSA-q3qx-cp62-f6m7 | Exploit Vendor Advisory |
| https://github.com/getgrav/grav/security/advisories/GHSA-q3qx-cp62-f6m7 | Exploit Vendor Advisory |
Configurations
History
03 Dec 2025, 21:58
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:getgrav:grav-plugin-admin:*:*:*:*:*:*:*:* | |
| References | () https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0 - Patch | |
| References | () https://github.com/getgrav/grav/security/advisories/GHSA-q3qx-cp62-f6m7 - Exploit, Vendor Advisory | |
| First Time |
Getgrav grav-plugin-admin
Getgrav |
02 Dec 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/getgrav/grav/security/advisories/GHSA-q3qx-cp62-f6m7 - |
01 Dec 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-01 22:15
Updated : 2025-12-03 21:58
NVD link : CVE-2025-66307
Mitre link : CVE-2025-66307
CVE.ORG link : CVE-2025-66307
JSON object : View
Products Affected
getgrav
- grav-plugin-admin
CWE
CWE-204
Observable Response Discrepancy