CVE-2025-66306: Getgrav Grav Information Disclosure Flaw

CVE-2025-66306 Overview

CVE-2025-66306 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Grav CMS Admin Panel. Grav is a popular file-based Web platform that does not require a database. This vulnerability allows authenticated low-privilege users to access sensitive information belonging to other user accounts within the Grav CMS installation.

While direct account takeover is not possible through this vulnerability, attackers can expose admin email addresses and other account metadata. This information disclosure significantly increases the risk of follow-up attacks including phishing campaigns, credential stuffing attacks, and social engineering attempts targeting administrators.

The vulnerability has been assigned a CVSS 3.1 score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network-based exploitation with low attack complexity requiring only low privileges and no user interaction.

Critical Impact

Low-privilege users can access sensitive admin account information including email addresses and metadata, enabling targeted phishing and social engineering attacks against administrators.

Affected Products

• Grav CMS versions prior to 1.8.0-beta.27
• Grav CMS 1.8.0-beta1 through 1.8.0-beta26
• All Grav CMS stable releases before the security patch

Discovery Timeline

• December 1, 2025 - CVE-2025-66306 published to NVD
• December 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-66306

Vulnerability Analysis

The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key. This weakness occurs when the application uses user-controllable input to access objects directly without proper authorization checks, allowing attackers to bypass access controls.

In the context of Grav CMS, the Admin Panel fails to properly validate whether the requesting user has authorization to access specific user account information. When a low-privilege user manipulates object reference parameters in API requests or form submissions, they can retrieve information about other user accounts that should be restricted.

The EPSS (Exploit Prediction Scoring System) data indicates a probability score of 0.032% with a percentile of 8.625, suggesting a relatively low likelihood of exploitation in the wild at this time.

Root Cause

The root cause of CVE-2025-66306 lies in insufficient authorization validation within the Grav CMS Admin Panel's user management functionality. The application fails to verify that the authenticated user has the necessary permissions to access the requested user object before returning sensitive data.

Specifically, the system accepts user-controlled parameters that reference other user accounts without performing adequate privilege checks. This allows any authenticated user with minimal privileges to enumerate and access information about other accounts, including administrator accounts.

Attack Vector

The attack vector is network-based, requiring an attacker to have a valid low-privilege account on the target Grav CMS installation. The exploitation flow involves:

1. An attacker authenticates to the Grav CMS Admin Panel with a low-privilege user account
2. The attacker identifies API endpoints or form submissions that accept user identifiers as parameters
3. By manipulating these user reference parameters (such as user IDs or usernames), the attacker can request information about other accounts
4. The server returns sensitive information about the targeted accounts without validating authorization

The vulnerability does not require any user interaction to exploit and has low attack complexity. The primary impact is on confidentiality, with high confidentiality impact and no direct impact on integrity or availability.

Since no verified code examples are available, interested parties should review the security advisory at GHSA-4cwq-j7jv-qmwg and the associated commit b7e1958a6e807ac14919447b60e5204a2ea77f62 for technical implementation details.

Detection Methods for CVE-2025-66306

Indicators of Compromise

• Unusual patterns of user account information queries from low-privilege accounts
• Multiple requests to user profile or account management endpoints with varying user identifiers
• Access logs showing a single authenticated user requesting information about multiple different accounts
• Failed or successful access attempts to admin user profile data from non-admin accounts

Detection Strategies

Organizations can implement the following detection strategies:

Log Analysis: Monitor Grav CMS access logs for patterns indicating IDOR exploitation attempts. Look for authenticated sessions making requests to user account endpoints with sequential or enumerated user identifiers.

Web Application Firewall (WAF) Rules: Configure WAF rules to detect and alert on suspicious parameter manipulation patterns in requests to the Admin Panel, particularly those involving user reference parameters.

Behavioral Analytics: Implement user behavior analytics to identify accounts that are accessing information about other users at an abnormal rate or pattern.

Access Control Auditing: Regularly audit access control configurations and review which users have accessed admin account information.

Monitoring Recommendations

Organizations should implement comprehensive monitoring including:

• Enable detailed access logging for the Grav CMS Admin Panel
• Configure alerts for anomalous user account query patterns
• Monitor for bulk data access attempts from low-privilege accounts
• Implement real-time alerting for access to sensitive admin account endpoints
• Review authentication logs for unusual session patterns or access from unexpected locations

How to Mitigate CVE-2025-66306

Immediate Actions Required

• Update Grav CMS to version 1.8.0-beta.27 or later immediately
• Conduct an audit of existing user accounts and their recent access patterns
• Review admin account information for any signs of exposure or misuse
• Implement additional access controls at the network level to restrict Admin Panel access
• Alert administrators to be vigilant against potential phishing attempts using exposed information

Patch Information

The vulnerability has been fixed in Grav CMS version 1.8.0-beta.27. The patch implements proper authorization checks to ensure that users can only access account information they are authorized to view.

The security patch is available via the official Grav GitHub repository:

• Commit:b7e1958a6e807ac14919447b60e5204a2ea77f62
• Security Advisory:GHSA-4cwq-j7jv-qmwg

Organizations should prioritize this update, particularly if their Grav CMS installations allow low-privilege user accounts to access the Admin Panel.

Workarounds

If immediate patching is not possible, organizations can implement the following temporary mitigations:

# Restrict Admin Panel access to trusted IP addresses
# Add to your web server configuration (Apache example)
<Directory "/path/to/grav/admin">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
    # Add your trusted admin IP addresses
</Directory>

Additional workaround strategies include:

• Temporarily disable or remove low-privilege user accounts until the patch can be applied
• Implement network segmentation to restrict Admin Panel access to trusted networks only
• Enable multi-factor authentication for all Admin Panel users to limit unauthorized account access
• Monitor admin email addresses for phishing attempts and warn administrators about potential social engineering risks