NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

CVE-2025-66306 — grav

MEDIUMFix: getgrav/grav@b7e1958

CVE-2025-66306 is a medium-severity (CVSS 4.3) CWE-639 vulnerability in getgrav/grav. A fix is available for getgrav/grav — see the affected versions and patch details below.

Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel

Also known asGHSA-4cwq-j7jv-qmwg
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 27, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-66306.

EPSS Exploitation Probability

via FIRST.org ↗
0.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs22th percentile — riskier than 22% of all scored CVEsHighest risk
0.00%0.27%0.53%0.80%0.0%0.3%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐘getgrav/grav

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

An IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS Admin Panel allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin email addresses and other metadata can be exposed, increasing the risk of phishing, credential stuffing, and social engineering.

Details

  • Endpoint: /admin/accounts/users/{username}
  • Tested Version: Grav Admin 1.7.48
  • Affected Accounts: Authenticated users with 0 privileges (non-privileged accounts)

Description: Requesting another user’s account details (e.g., /admin/accounts/users/admin) as a low-privilege user returns an HTTP 403 Forbidden response. However, sensitive information such as the admin’s email address is still present in the response source, specifically in the <title> tag.

system/src/Grav/Common/Flex/Types/Users/UserCollection.php <img width="700" height="327" alt="Screenshot 2025-08-24 021027" src="https://github.com/user-attachments/assets/7e69ae49-d8fc-442f-b00c-9efaec706b2e" />

system/blueprints/flex/user-accounts.yaml <img width="700" height="300" alt="Screenshot 2025-08-24 020521" src="https://github.com/user-attachments/assets/756631c8-d60b-4b84-a08a-2a9c2f81b41f" />

This is a classic IDOR vulnerability, where object references (usernames) are not properly protected from unauthorized enumeration.

PoC

  1. Log in as a non-privileged user (0-privilege account).

  2. Access another user’s endpoint, for example:

    GET /admin/accounts/users/admin

  3. Observe the HTTP 403 Forbidden response.

  4. Inspect the page source; sensitive data such as the admin email can be seen in the <title> tag.

PoC Video:

https://drive.google.com/file/d/1lY_qwqSkN5sPNmHvXGOk6R1mdIgVt71H/view

Impact

  • Type: Information Disclosure via IDOR
  • Who is impacted: Low-privilege authenticated users can enumerate other accounts and extract sensitive metadata (admin emails).
  • Risk: Exposed information can be used for targeted phishing, credential stuffing, brute-force attacks, or social engineering campaigns.
  • Severity Justification: Only a low-privilege account is required, and sensitive metadata is leaked. Arbitrary code execution is not possible, but the information exposure is moderate risk.

Disclosure & CVE Request

  • We request a CVE ID for this vulnerability once validated.

  • Please credit the discovery to:

    • Elvin Nuruyev
    • Kanan Farzalili

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistgetgrav/gravall versions1.8.0-beta.27composer require getgrav/grav:^1.8.0-beta.27

Affected Products

1 product · 27 configurations
Application
gravgetgrav
≥ 1.7.48 && < 1.8.0
1 version
1.8.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for getgrav/grav, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update getgrav/grav to 1.8.0-beta.27 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-66306 is resolved across your whole dependency graph.

  3. Workarounds

    Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Frequently Asked Questions

## **Summary** An **IDOR (Insecure Direct Object Reference)** vulnerability in the Grav CMS Admin Panel allows **low-privilege users to access sensitive information** from other accounts. Although direct account takeover is not possible, **admin email addresses and other metadata can be exposed**, increasing the risk of phishing, credential stuffing, and social engineering. --- ## **Details** * **Endpoint:** `/admin/accounts/users/{username}` * **Tested Version:** Grav Admin 1.7.48 * **Affected Accounts:** Authenticated users with **0 privileges** (non-privileged accounts) **Description:*
O3 Security · Impact-Aware SCA

Is CVE-2025-66306 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2025-66306: grav RCE — Fix Available