# CVE-2025-66307: grav Info Disclosure — Fix Available

🐘

🐘 Packagist

Not in CISA KEV

MEDIUM severity

# CVE-2025-66307 — grav

MEDIUM [Fix: getgrav/grav-plugin-admin@99f6532](https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0)

CVE-2025-66307 is a medium-severity (CVSS 6.5) CWE-204 vulnerability in getgrav/grav. A fix is available for getgrav/grav — see the affected versions and patch details below.

Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure

Also known as[GHSA-q3qx-cp62-f6m7](/vulnerability/GHSA-q3qx-cp62-f6m7)

Published

Dec 1, 2025

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### Proof-of-concept exploit code exists

-   CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
-   CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-66307.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.3%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs28th percentile — riskier than 28% of all scored CVEsHighest risk

0.00%0.28%0.56%0.84%0.1%0.3%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

1 pkg affected

🐘`getgrav/grav`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

## Description

## Grav v1.7.49.5 / Admin v1.10.49.1 – User Enumeration & Email Disclosure

#### Summary

A **user enumeration and email disclosure vulnerability** exists in Grav **v1.7.49.5** with Admin plugin **v1.10.49.1**.  
The "Forgot Password" functionality at `/admin/forgot` leaks information about valid usernames and their associated email addresses through distinct server responses.  
This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering.

#### Details

The issue resides in the [`taskForgot()`](https://github.com/getgrav/grav-plugin-admin/blob/6d673fc7c4f6962756f93ae651371e81f7f20924/classes/plugin/Controllers/Login/LoginController.php#L349) function, which handles the forgot password workflow.  
Relevant vulnerable logic:

```
if (null === $user || $user->state !== 'enabled' || !$to) {
    ...
    // Generic message for invalid/non-existing users
    $this->setMessage($this->translate('PLUGIN_ADMIN.FORGOT_INSTRUCTIONS_SENT_VIA_EMAIL'));
    return $this->createRedirectResponse($current);
}

if ($rateLimiter->isRateLimited($username)) {
    ...
    $interval = $config->get('plugins.login.max_pw_resets_interval', 2);

    // Sensitive message for valid users
    $this->setMessage($this->translate('PLUGIN_LOGIN.FORGOT_CANNOT_RESET_IT_IS_BLOCKED', $to, $interval), 'error');

    return $this->createRedirectResponse($current);
}
```

When an attacker submits the password reset form at `/admin/forgot` with an **invalid username**, the application responds with:

```
Instructions to reset your password have been sent to your email address
```

However, when a **valid username** is supplied, and the attacker repeatedly triggers password reset requests, the application responds with:

```
Cannot reset password for <USER_EMAIL>, password reset functionality temporarily blocked, please try later (maximum 60 minutes)
```

This discrepancy in responses enables:

1.  **User Enumeration** – Attackers can determine if a username exists in the system by analyzing the response.
2.  **User Email Disclosure** – The system discloses the actual email address associated with the account (e.g., `admin@localhost.test`).

This violates best practices for authentication flows, where responses should remain generic to avoid leaking sensitive information.

#### PoC

1.  Navigate to the **Forgot Password** page: `https://<target>/admin/forgot`
2.  Submit a reset request with a random/invalid username (e.g., `invalid_user`):

-   Response:
    
    ```
    Instructions to reset your password have been sent to your email address
    ```
    

1.  Submit a reset request with a valid username (e.g., `admin`).
2.  Repeatedly request a reset for the same username until the lockout mechanism triggers.

-   Response:
    
    ```
    Cannot reset password for admin@localhost.test, password reset functionality temporarily blocked, please try later (maximum 60 minutes)
    ```
    

1.  Observe the leaked **email address** of the admin account in the error message.

#### Impact

-   **Severity:** Medium
-   **Type:** Information Disclosure / User Enumeration
-   **Who is Impacted:** All Grav sites using Admin plugin **v1.10.49.1** with password reset enabled.
-   **Risks:**
    -   Allows attackers to enumerate valid usernames.
    -   Exposes email addresses of admin accounts, which can be used in:
    -   Credential stuffing
    -   Password spraying
    -   Phishing/social engineering campaigns
    -   Further exploitation in combination with other vulnerabilities

#### Recommendation

-   Modify the [`taskForgot()`](https://github.com/getgrav/grav-plugin-admin/blob/6d673fc7c4f6962756f93ae651371e81f7f20924/classes/plugin/Controllers/Login/LoginController.php#L349) logic to always return a generic, non-identifying message, regardless of whether the username exists or rate limits are hit.
    
-   Example safe response:
    
    ```
    If the account exists, password reset instructions will be sent.
    ```
    
-   Do not include email addresses ($to) or other sensitive data in error messages.
    

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

🐘Packagist

`getgrav/grav` 

all versions

1.8.0-beta.27`composer require getgrav/grav:^1.8.0-beta.27`

## Affected Products

1 product · 1 configurations

Application

`grav-plugin-admin`getgrav

≤ 1.10.50

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for getgrav/grav, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update getgrav/grav to 1.8.0-beta.27 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-66307 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.
    

## Frequently Asked Questions

\# Grav v1.7.49.5 / Admin v1.10.49.1 – User Enumeration & Email Disclosure ### Summary A \*\*user enumeration and email disclosure vulnerability\*\* exists in Grav \*\*v1.7.49.5\*\* with Admin plugin \*\*v1.10.49.1\*\*. The "Forgot Password" functionality at \`/admin/forgot\` leaks information about valid usernames and their associated email addresses through distinct server responses. This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering. ### Details The issue resides

O3 Security · Impact-Aware SCA

### Is CVE-2025-66307 in your dependencies?

Find it across Packagist, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)