CVE-2026-100672: Grav CMS Comments Plugin Auth Bypass

CVE-2026-100672 is an authentication bypass flaw in Grav CMS Comments plugin that exposes comment data without authentication checks. Attackers can retrieve comments, email addresses, and server paths. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-100672 Overview

CVE-2026-100672 is an unauthenticated information disclosure vulnerability in the Grav CMS Comments plugin (getgrav/grav-plugin-comments) through version 1.2.10. The plugin registers an admin handler that returns comment data as JSON without any authentication check. The handler relies on isAdmin(), which only confirms the admin route is registered rather than that the visitor is authenticated. An unauthenticated remote attacker can request /admin/comments/page:<n> and retrieve every comment from the last 7 days, including commenter email addresses and the absolute server filesystem path to the data file. The issue is tracked as [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Unauthenticated remote attackers can exfiltrate recent comment data, commenter email addresses, and absolute server filesystem paths from any affected Grav site using the classic Admin plugin.

Affected Products

Grav CMS Comments plugin (getgrav/grav-plugin-comments) through version 1.2.10
Grav sites using the classic Admin plugin with Comments enabled (the default configuration)
Not affected: Grav 2.0 Admin Next stack (admin2 + api)

Discovery Timeline

2026-09-26 - CVE-2026-100672 published to the National Vulnerability Database (NVD)
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100672

Vulnerability Analysis

The Comments plugin registers an admin route handler that returns stored comment data as a JSON response. The handler branches on isAdmin() to decide whether to serve the data. In Grav, isAdmin() indicates only that the admin service is registered on the current route. It does not confirm the requesting client is an authenticated administrator.

The handler echoes the JSON payload and calls exit() during the plugins stage. This terminates the request before the classic Admin plugin reaches the point where it would otherwise render a login screen. The result is that an unauthenticated HTTP request to the admin comments route returns comment data directly in the response body.

The exposed data covers all comments from the last 7 days. Each record includes the commenter's email address and the absolute filesystem path of the backing data file on the server. The absolute path leaks installation layout and hosting details useful for follow-on attacks against the host.

Root Cause

The root cause is a missing authentication check on a sensitive admin endpoint [CWE-306]. The plugin treats isAdmin() as an authorization gate when it is only a routing predicate. No session, token, or capability check is performed before the JSON response is emitted.

Attack Vector

An attacker sends an unauthenticated GET request to a path such as /admin/comments/page:0.001 on a vulnerable Grav instance. The server returns a JSON document containing recent comments, commenter email addresses, and the absolute filePath of the comments data file. No credentials, user interaction, or elevated privileges are required.

Detection Methods for CVE-2026-100672

Indicators of Compromise

Unauthenticated HTTP GET requests to URIs matching /admin/comments/page:* returning HTTP 200 with a JSON body.
Access log entries for /admin/comments/ paths from source IPs that have no prior authenticated admin session.
JSON responses from the admin route containing email fields and absolute filesystem paths such as /var/www/....

Detection Strategies

Review web server access logs for requests to /admin/comments/page: prefixes, especially from unauthenticated clients or anonymous sources.
Compare request patterns against normal admin usage; legitimate admin traffic typically follows a login POST and includes session cookies.
Correlate bursts of requests iterating page: values, which indicate enumeration of paginated comment data.

Monitoring Recommendations

Alert on any response from /admin/comments/* that returns a Content-Type: application/json body to a request without a valid admin session cookie.
Monitor outbound data volume from the /admin/comments/ route for anomalies consistent with bulk extraction.
Track Grav Comments plugin versions across hosted sites and flag any instance running 1.2.10 or earlier.

How to Mitigate CVE-2026-100672

Immediate Actions Required

Upgrade the Comments plugin to version 1.2.11 or later on all Grav installations that use the classic Admin plugin.
Audit web server access logs for prior unauthenticated requests to /admin/comments/page:* and treat any 200 responses as potential data exposure.
Notify commenters if logs indicate their email addresses may have been exfiltrated.

Patch Information

The issue is fixed in Comments plugin version 1.2.11. The patch requires an authenticated user with the admin.comments or admin.super permission before returning data and removes the absolute filePath field from the JSON response. See the GitHub Security Advisory GHSA-3cq9-f4pf-hq59 and the VulnCheck Advisory for Grav Plugin for additional detail.

Workarounds

Disable the Comments plugin until it can be upgraded to 1.2.11 on sites running the classic Admin stack.
Restrict access to the /admin/ path at the web server or reverse proxy layer using IP allowlists or HTTP authentication.
Migrate to the Grav 2.0 Admin Next stack (admin2 + api), which is not affected via this path.

bash

# Example nginx restriction limiting /admin/ to a management network
location ^~ /admin/ {
    allow 10.0.0.0/8;
    deny all;
    try_files $uri $uri/ /index.php?$query_string;
}