Grav Admin2 Plugin Information Disclosure Vulnerability

Executive Summary

The CVE-2026-61454 vulnerability involves the Grav CMS Admin2 plugin exposing sensitive internal configuration details through a global JavaScript variable called window.__GRAV_CONFIG__.

This variable is embedded in every unauthenticated response to the /grav/admin endpoint, including its subroutes and even 404 errors.

It discloses critical information such as the exact Grav version, Admin2 version, server URL, API prefix, and environment type.

This information disclosure allows an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without needing to perform reconnaissance.

The vulnerability affects Grav Admin2 plugin versions before 2.0.4 and was patched in version 2.0.4.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting the responses from the /grav/admin endpoint and its subroutes on your Grav CMS server. Specifically, you should look for the presence of the global JavaScript variable window.__GRAV_CONFIG__ in the HTML or JavaScript content of unauthenticated responses.

A simple way to check this is by using command-line tools like curl or wget to fetch the /grav/admin page and then searching for the variable in the response.

• curl -s http://your-grav-site/grav/admin | grep '__GRAV_CONFIG__'
• wget -qO- http://your-grav-site/grav/admin | grep '__GRAV_CONFIG__'

If the variable is present in the response without authentication, it indicates the vulnerability exists.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthenticated attackers to gain detailed information about your Grav CMS deployment.

With access to exact version numbers, server URL, API prefix, and environment type, attackers can bypass reconnaissance and directly target known vulnerabilities specific to your versions.

This increases the risk of targeted exploits, potentially leading to further compromise of your system.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability disclosed by CVE-2026-61454 involves exposure of internal configuration details such as server URL, API prefix, environment type, and exact software versions through unauthenticated responses. While this information disclosure does not directly expose personal or sensitive user data, it facilitates targeted attacks by allowing attackers to fingerprint the deployment and exploit known vulnerabilities without prior reconnaissance.

This indirect risk could impact compliance with standards like GDPR or HIPAA if an attacker leverages this information disclosure to gain unauthorized access to protected data or systems. Therefore, although the vulnerability itself is a configuration information leak, it may contribute to non-compliance by increasing the risk of successful attacks that compromise confidentiality, integrity, or availability of regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Grav Admin2 plugin to version 2.0.4 or later, where this vulnerability has been patched.

Until the upgrade can be applied, consider restricting access to the /grav/admin endpoint and its subroutes by implementing authentication or IP-based access controls to prevent unauthenticated users from accessing these pages.

Additionally, monitor your system for any suspicious activity that might indicate attempts to exploit this information disclosure.

Useful 0 Not Useful 0