Unauthenticated Information Disclosure in Grav CMS by GetGrav

CVE-2026-92916

What is CVE-2026-92916?

Grav is a flat-file content management system (CMS) that is susceptible to an unauthenticated information disclosure issue. This vulnerability arises when the debugger is enabled, exposing the Clockwork profiler endpoint without requiring authentication. An attacker can exploit this by accessing sensitive information, such as raw request cookies—including session identifiers, user credentials, and other configuration settings—thus potentially taking over user sessions. Although the issue primarily affects Grav CMS versions 1.7.0 to 1.7.53.2 and 2.0.0 to 2.0.21, it has been addressed in the subsequent releases. Recommendations for users include disabling the debugger or blocking access to the affected endpoint.

References