CVE-2026-61454
Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__
CVSS Score
5.3
EPSS Score
0.2%
EPSS Percentile
15th
The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin (and its subroutes). This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers, allowing an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without reconnaissance.
| CWE | CWE-200 |
| Vendor | getgrav |
| Product | grav |
| Published | Jul 11, 2026 |
| Last Updated | Jul 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for getgrav grav
Be the first to know when new medium vulnerabilities affecting getgrav grav are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
getgrav / grav
0 < 2.0.4
References
Credits
🔍 nicl4ssic