CVE-2026-100672
Deferred Deferred - Pending Action

Comments Plugin in Grav CMS Exposes Comment Data

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the admin service is registered on the current route rather than that the visitor is authenticated, and it echoes the JSON and calls exit() during the plugins stage, before the classic Admin plugin would render its login screen. On a site using the classic Admin plugin with Comments enabled (the default), an unauthenticated remote attacker can request /admin/comments/page:<n> (e.g. page:0.001) and retrieve every comment from the last 7 days, including each commenter's email address and the absolute server filesystem path of the data file. Sites running the Grav 2.0 Admin Next stack (admin2 + api) are not affected via this path. The issue is fixed in 1.2.11, which requires an authenticated user with admin.comments or admin.super and removes the absolute filePath from the response.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100672
EUVD
EUVD-2026-87766

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav-plugin-comments to 1.2.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated information disclosure vulnerability in the Grav CMS Comments plugin (versions <= 1.2.10). The issue occurs when the classic Admin plugin is installed alongside the Comments plugin. An anonymous visitor can access the endpoint /admin/comments/page:<n> to retrieve all comments from the last 7 days, including commenter email addresses and absolute server file paths where comment data is stored.

Detection Guidance

Check if the Comments plugin version is 1.2.10 or earlier by inspecting Grav CMS plugin files. Test for unauthenticated access by attempting to request /admin/comments/page:0.001 via curl or browser. If the response contains comment data including emails and file paths, the system is vulnerable.

Impact Analysis

The vulnerability allows attackers to access sensitive comment data, including user emails and server file paths. This information could aid further attacks, such as targeted phishing or server exploitation. Sites using the Grav 2.0 Admin Next stack are not affected.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal data (email addresses) and potential exposure of server paths. GDPR requires protection of personal data, and HIPAA mandates safeguards for sensitive health information.

Mitigation Strategies

Upgrade the Comments plugin to version 1.2.11 or later. If upgrading is not possible, disable the Comments plugin immediately. Ensure the Grav 2.0 Admin Next stack is used if possible, as it is not affected by this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100672. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart