CVE-2026-92916: Grav CMS Information Disclosure Vulnerability

CVE-2026-92916 Overview

CVE-2026-92916 is an information disclosure vulnerability in Grav, a flat-file content management system (CMS). When the debugger is enabled, the Clockwork profiler endpoint is exposed without authentication. Unauthenticated attackers can retrieve stored request records containing session cookies, plaintext credentials, and system configuration secrets. The flaw affects Grav versions 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21. It is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can harvest admin session cookies, plaintext login passwords, SMTP credentials, third-party API keys, and licence keys from any Grav site running the debugger.

Affected Products

Grav CMS 1.7.0 through 1.7.53.2
Grav CMS 2.0.0 through 2.0.21
Grav installations with system.debugger.enabled: true

Discovery Timeline

2026-09-17 - CVE-2026-92916 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92916

Vulnerability Analysis

The vulnerability resides in Grav's bootstrap routing for the Clockwork profiler. The InitializeProcessor::handleDebuggerRequest() method intercepts any request path containing /__clockwork/ and forwards it to Debugger::debuggerRequest(). This handler performs no user lookup, no IP restriction, and no Clockwork authenticator check.

The endpoint also supports anonymous pagination across the entire stored history. An attacker can enumerate every previously profiled request without credentials.

Grav ships with censored: false as the default. Each stored record therefore contains raw request cookies, the fully parsed request body, and the site's complete system and plugin configuration. The Grav session cookie carries the raw PHP session id, which lets an attacker resume any active session, including an authenticated administrator's. Grav's login form posts credentials as data[username] and data[password], so passwords are captured in plaintext because Clockwork's password filter only inspects top-level keys.

Even when operators set censored: true, Authorization and X-API-Token headers remain stored. On Grav 2.0, switching provider: debugbar does not help because Grav forces the Clockwork provider for any request preferring a JSON response.

Root Cause

The root cause is a missing authorization check on a debug endpoint combined with insecure default configuration in the profiler's data retention. Sensitive fields are stored verbatim rather than filtered before persistence.

Attack Vector

An attacker sends unauthenticated HTTP requests to /__clockwork/ on any Grav instance with the debugger enabled. The server returns JSON records containing session cookies, credentials, and configuration secrets. Attackers can then replay the PHP session id to impersonate authenticated admins or reuse extracted API keys against upstream services. See the GitHub Security Advisory and the VulnCheck Advisory on Grav for full technical details.

Detection Methods for CVE-2026-92916

Indicators of Compromise

Unauthenticated HTTP requests to any URL path containing /__clockwork/ in web server access logs.
Sequential or paginated requests to Clockwork history endpoints originating from a single external IP.
Unexpected admin sessions or logins immediately following external /__clockwork/ traffic.
Reuse of SMTP or third-party API credentials outside normal server egress patterns.

Detection Strategies

Review web server, reverse proxy, and CDN access logs for any external requests to /__clockwork/* paths.
Alert on HTTP 200 responses to /__clockwork/ from non-loopback source addresses.
Correlate Clockwork endpoint access with subsequent authenticated admin activity from new IPs or user agents.
Audit Grav configuration files for system.debugger.enabled: true on internet-facing installations.

Monitoring Recommendations

Deploy web application firewall (WAF) rules that block or alert on /__clockwork/ requests to production hosts.
Ingest Grav web server logs into a centralized logging platform and build detections for the Clockwork URI pattern.
Monitor for anomalous outbound use of SMTP credentials and API keys that may have been exfiltrated.

How to Mitigate CVE-2026-92916

Immediate Actions Required

Upgrade Grav to version 1.7.53.4 or 2.0.22 immediately on all affected installations.
Set system.debugger.enabled: false in system.yaml on any production or internet-exposed instance.
Rotate all secrets that may have been exposed, including admin passwords, PHP session ids, SMTP credentials, third-party API keys, and licence keys.
Invalidate all active user sessions and force re-authentication for administrators.

Patch Information

The issue is fixed in Grav 1.7.53.4 and 2.0.22. The patches restrict /__clockwork/ access to server-local requests or requests presenting the new system.debugger.token secret. The fix also strips cookies and credential headers from stored profiler records. Refer to the GitHub Security Advisory GHSA-q3ff-cj6v-rr5g for release details.

Workarounds

Set debugger.enabled: false in the Grav system configuration to disable the Clockwork endpoint entirely.
Block all external requests to /__clockwork/ at the web server, reverse proxy, or CDN layer.
Restrict access to the debugger endpoint by source IP so only trusted developer networks can reach it.

bash

# Nginx configuration example to block Clockwork externally
location ~ ^/__clockwork/ {
    allow 127.0.0.1;
    deny all;
    return 404;
}