CVE-2026-61454CWE-200

Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__

High · published July 11, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
28.4
In the wild
Unconfirmed
What it is

The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin (and its subroutes). This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers, allowing an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without reconnaissance.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00358 · 28.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-07-11T13:01Z
EPSS history
Timeline
  • 11 JUL 13:01Z
    Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__
    cvelistv5