Authentication Bypass in Grav Profiler Affects Multiple Versions from Vendor Grav
CVE-2026-109325

8.7HIGH

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109325?

Grav versions prior to 2.1.7 are vulnerable to an authentication bypass within the Clockwork profiler. This flaw arises due to the trust placed in loopback REMOTE_ADDR values, allowing unauthenticated attackers situated behind the same-host HTTP proxy to access profiler records. Consequently, sensitive system and plugin configurations, along with request metadata and queries, may be exposed, increasing the risk of further attacks.

Affected Version(s)

grav 2.0.22 < 2.1.7

grav 2.1.7

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/grav-from-2.0.22-bef...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zagn
.