Insecure Direct Object Reference Vulnerability in Grav CMS Admin Panel

CVE-2025-66306

What is CVE-2025-66306?

The Grav CMS Admin Panel has a security flaw that allows low-privilege users to access sensitive information associated with other accounts due to an Insecure Direct Object Reference (IDOR) issue. While direct account takeover is not feasible, this vulnerability could lead to the exposure of admin email addresses and other metadata. Such exposure heightens the risk of phishing attacks, credential stuffing, and various forms of social engineering. The issue has been addressed in version 1.8.0-beta.27, emphasizing the necessity for users to upgrade to protect sensitive information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References