CVE-2026-61454: Grav Admin2 Information Disclosure Issue

CVE-2026-61454 Overview

CVE-2026-61454 is an information disclosure vulnerability in the Grav Admin2 plugin (getgrav/grav-plugin-admin2) before version 2.0.4. The plugin embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 single-page application (SPA) bootstrap page served at /grav/admin and its subroutes. This object appears in every unauthenticated response and exposes the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers. An unauthenticated remote attacker can fingerprint the deployment and select version-specific exploits without prior reconnaissance. The issue is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can retrieve exact Grav and Admin2 version numbers along with internal configuration paths, enabling precise targeting of known CMS vulnerabilities.

Affected Products

Grav CMS with the Admin2 plugin (getgrav/grav-plugin-admin2) installed
Grav Admin2 plugin versions prior to 2.0.4
Any Grav deployment exposing the /grav/admin route to unauthenticated clients

Discovery Timeline

2026-07-11 - CVE-2026-61454 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-61454

Vulnerability Analysis

The Grav Admin2 plugin is a modern SPA-based administration interface for the Grav flat-file CMS. During bootstrap, the plugin injects a global JavaScript configuration object named window.__GRAV_CONFIG__ directly into the HTML response returned by /grav/admin and its subroutes. This configuration object is intended for the browser-side application but is served unconditionally, including to unauthenticated clients.

Because the response is generated before any authentication check, a simple HTTP GET request against the admin endpoint returns the full configuration payload. The payload discloses the server URL, API prefix, admin base path, runtime environment identifier (for example development or production), the Grav core version, and the Admin2 plugin version. An attacker uses this information to map internal routing, identify the runtime posture, and correlate exact version strings to public vulnerability databases.

The vulnerability itself does not grant code execution or authentication bypass. However, it removes the reconnaissance barrier that separates opportunistic scanning from targeted exploitation. See the GitHub Security Advisory for the vendor description.

Root Cause

The root cause is the unconditional embedding of sensitive configuration metadata into the SPA bootstrap HTML. The plugin does not gate the window.__GRAV_CONFIG__ payload behind authentication and does not strip version identifiers or environment markers before serving the page to anonymous clients.

Attack Vector

Exploitation requires only network access to the Grav admin URL. The attacker issues an unauthenticated HTTP GET request to /grav/admin or any of its subroutes and parses the returned HTML for the inline window.__GRAV_CONFIG__ assignment. No credentials, user interaction, or complex conditions are required. The disclosed version data then drives selection of version-specific exploits against the underlying Grav installation.

Refer to the VulnCheck Advisory on Grav for exploitation context.

Detection Methods for CVE-2026-61454

Indicators of Compromise

Unauthenticated HTTP GET requests to /grav/admin and its subroutes from external IP ranges, particularly from scanners or non-browser user agents
Web server access logs showing repeated 200 OK responses to /grav/admin from clients that never proceed to authenticated endpoints
Response bodies containing the string window.__GRAV_CONFIG__ served to clients without a valid admin session cookie

Detection Strategies

Inspect outbound HTML from the Grav admin route and alert on the presence of window.__GRAV_CONFIG__ in responses returned to unauthenticated sessions
Correlate access log entries for /grav/admin with subsequent probes against known Grav CVEs matching the disclosed version string
Fingerprint installed Grav Admin2 plugin versions across the estate and flag any instance below 2.0.4

Monitoring Recommendations

Enable HTTP response body logging on the reverse proxy or Web Application Firewall (WAF) fronting Grav to capture disclosure attempts
Monitor for enumeration patterns where a single source requests /grav/admin followed by targeted exploit paths within a short time window
Track user-agent diversity and request frequency against admin endpoints to identify automated fingerprinting

How to Mitigate CVE-2026-61454

Immediate Actions Required

Upgrade the Grav Admin2 plugin to version 2.0.4 or later on all affected Grav installations
Restrict access to /grav/admin and its subroutes at the network or reverse proxy layer to trusted administrative source IPs
Audit web server logs for prior unauthenticated requests to /grav/admin and treat matching sources as reconnaissance candidates

Patch Information

The vendor addressed the issue in Grav Admin2 plugin version 2.0.4. The fix removes or gates the embedded window.__GRAV_CONFIG__ payload so version and configuration metadata are no longer disclosed to unauthenticated clients. See the GitHub Security Advisory GHSA-pfjq-chp8-3vgh for release details.

Workarounds

Place the Grav admin path behind an authenticating reverse proxy or VPN so anonymous clients cannot retrieve the bootstrap HTML
Deploy a WAF rule that strips or blocks responses containing window.__GRAV_CONFIG__ when the requesting session is not authenticated
Remove or disable the Admin2 plugin if it is not actively required in the deployment

bash

# Example nginx access restriction for the Grav admin path
location /grav/admin {
    allow 10.0.0.0/8;      # trusted admin network
    deny  all;
    proxy_pass http://grav_backend;
}