CVE-2026-62673: Grav Auth Bypass Vulnerability

CVE-2026-62673 Overview

CVE-2026-62673 affects Grav, a file-based web content management platform. The vulnerability exists in the .htaccess and webserver-configs/htaccess.txt security rules shipped prior to version 2.0.4. These rules omit the Apache [NC] (no-case) flag, causing sensitive directory and file-extension patterns to match case-sensitively. On case-insensitive filesystems, an unauthenticated remote requester can substitute uppercase characters in URL paths to bypass the deny rules. Successful exploitation returns files stored under user/accounts or user/config, including administrator password hashes and security configuration data. The issue is tracked as [CWE-178: Improper Handling of Case Sensitivity] and fixed in Grav 2.0.4.

Critical Impact
Unauthenticated attackers can retrieve password hashes and configuration secrets from Grav installations running on case-insensitive filesystems by requesting protected paths with altered letter case.

Affected Products

Grav CMS versions prior to 2.0.4
Grav deployments on case-insensitive filesystems (Windows NTFS, macOS default HFS+/APFS)
Grav webserver-configs/htaccess.txt template distributed with vulnerable releases

Discovery Timeline

2026-08-19 - CVE-2026-62673 published to NVD
2026-08-19 - Last updated in NVD database
Fix released - Grav 2.0.4 published on GitHub Release 2.0.4
Advisory - Published as GHSA-vwg3-w8w3-pc79

Technical Details for CVE-2026-62673

Vulnerability Analysis

Grav relies on Apache mod_rewrite rules in .htaccess to deny direct HTTP access to sensitive directories and file types. The shipped ruleset uses lowercase patterns such as ^(user)/(accounts|config|data|env)/(.*) combined with the [F] (Forbidden) flag. Apache's regex engine treats these patterns case-sensitively by default. A request for /User/Accounts/admin.yaml therefore does not match the deny rule and is passed through to the filesystem. On Windows NTFS and default macOS APFS, the filesystem resolves the mixed-case path to the actual lowercase file and returns its contents. The exposed files include YAML documents holding bcrypt password hashes, session secrets, API tokens, and email configuration.

Root Cause

The root cause is the absence of the Apache [NC] (no-case) flag on every RewriteRule in the security section of .htaccess and webserver-configs/htaccess.txt. Regex matching in mod_rewrite is case-sensitive without this flag, while common filesystems used for hosting Grav are case-insensitive. This mismatch [CWE-178] between rule semantics and filesystem behavior creates the bypass primitive.

Attack Vector

An unauthenticated attacker sends an HTTP GET request to a normally protected path, altering the case of at least one segment. Example targets include /User/accounts/admin.yaml, /USER/config/security.yaml, and /user/Accounts/admin.YAML. No authentication, session, or user interaction is required. The attacker retrieves credentials that can then be used to authenticate to the Grav admin panel or reused against other services.

text

## Begin - Security
# Block all direct access for these folders
-RewriteRule ^(\.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F]
+RewriteRule ^(\.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F,NC]
# Block all direct access to these sensitive user folders, whatever the file type
-RewriteRule ^(user)/(accounts|config|data|env)/(.*) error [F]
+RewriteRule ^(user)/(accounts|config|data|env)/(.*) error [F,NC]
# Block access to specific file types for these system folders
-RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F]
+RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F,NC]
# Block all direct access to .md files:
-RewriteRule \.md$ error [F]
+RewriteRule \.md$ error [F,NC]
# Block access to specific files in the root folder
-RewriteRule ^(LICENSE\.txt|composer\.lock|composer\.json|\.htaccess)$ error [F]
+RewriteRule ^(LICENSE\.txt|composer\.lock|composer\.json|\.htaccess)$ error [F,NC]
## End - Security

Source: Grav commit 8c9d1e7b. The patch adds the NC flag to every security-related RewriteRule so that case variations are matched and denied.

Detection Methods for CVE-2026-62673

Indicators of Compromise

HTTP 200 responses to requests for /user/accounts/*, /user/config/*, or /user/env/* with mixed-case path segments.
Access log entries containing uppercase letters in the user, accounts, config, data, or env path components.
Requests for YAML, JSON, or Markdown files under user/ where the extension case differs from the on-disk file (for example .YAML, .Yml, .MD).
Sudden read activity on user/accounts/*.yaml files from unusual source IPs.

Detection Strategies

Parse Apache and Nginx access logs for path segments matching (?i)(user|system|vendor|cache|bin|logs|backup|webserver-configs|tests) where at least one character is uppercase.
Correlate HTTP 200 responses on these paths with the file being present on disk to confirm the bypass succeeded.
Alert on any successful read of files under user/accounts/ or user/config/ served directly by the web server rather than routed through PHP.

Monitoring Recommendations

Ingest web server access logs into a centralized analytics platform and apply case-insensitive path-matching rules against the Grav protected-path list.
Monitor filesystem read events on user/accounts/*.yaml outside of the PHP-FPM process context.
Track outbound requests from Grav hosts after suspicious path probing, which may indicate credential exfiltration.

How to Mitigate CVE-2026-62673

Immediate Actions Required

Upgrade Grav to version 2.0.4 or later using the official Grav 2.0.4 release.
Rotate all administrator passwords and any secrets stored under user/config/ and user/accounts/ in case files were previously disclosed.
Review access logs for prior exploitation attempts using mixed-case path requests against protected directories.
Regenerate session and API keys defined in Grav configuration files.

Patch Information

The fix is delivered in Grav 2.0.4 via commit 8c9d1e7b. It appends the [NC] flag to every security-relevant RewriteRule in both .htaccess and webserver-configs/htaccess.txt, forcing case-insensitive matching that aligns with the underlying filesystem behavior. Full details are published in GHSA-vwg3-w8w3-pc79.

Workarounds

If immediate patching is not possible, manually edit .htaccess and add ,NC to the flags list of every RewriteRule in the ## Begin - Security block.
Deploy Grav on a case-sensitive filesystem such as ext4 or XFS to prevent the mismatch that enables the bypass.
Front the Grav web server with a reverse proxy or WAF that denies requests to (?i)^/(user|system|vendor|cache|bin|logs|backup|webserver-configs|tests)(/|$) and their file-extension variants.
Restrict direct web access to the user/accounts, user/config, and user/env directories at the server configuration level rather than relying solely on .htaccess.

bash

# Apache .htaccess patch - add NC flag to security RewriteRules
RewriteRule ^(\.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F,NC]
RewriteRule ^(user)/(accounts|config|data|env)/(.*) error [F,NC]
RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F,NC]
RewriteRule ^(user)/(.*)\.(txt|md|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F,NC]
RewriteRule \.md$ error [F,NC]
RewriteRule ^(LICENSE\.txt|composer\.lock|composer\.json|\.htaccess)$ error [F,NC]