CVE-2026-61454
MEDIUMGrav before 2.0.4 Information Disclosure via __GRAV_CONFIG__
Title source: cnaDescription
The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin (and its subroutes). This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers, allowing an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without reconnaissance.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-pfjq-chp8-3vgh)
https://github.com/getgrav/grav/security/advisories/GHSA-pfjq-chp8-3vgh
Third Party Advisory third-party-advisory
VulnCheck Advisory: Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__
https://www.vulncheck.com/advisories/grav-before-information-disclosure-via-grav-config
Scores
CVSS v3
5.3
EPSS
0.0024
EPSS Percentile
15.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-200
Status
published
Products (2)
getgrav/grav
< 2.0.4
getgrav/grav
2.0.4
Published
Jul 11, 2026
Tracked Since
Jul 11, 2026