CVE-2026-109325
Deferred Deferred - Pending Action

Authentication Bypass in Grav CMS via Clockwork Profiler

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109325
EUVD
EUVD-2026-97627

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav 2.0.22

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in Grav's Clockwork profiler. It affects versions 2.0.22 through 2.1.6. The issue occurs when Grav is behind a same-host HTTP proxy. The system incorrectly trusts loopback REMOTE_ADDR values, allowing unauthenticated attackers to access sensitive profiler records.

Detection Guidance

Check Grav logs for unauthorized access to the Clockwork profiler endpoint. Look for requests to /_profiler/ with REMOTE_ADDR values matching loopback addresses (e.g., 127.0.0.1) without valid authentication tokens. Inspect network traffic for same-host proxy connections accessing Grav's debug endpoints.

Impact Analysis

Unauthenticated attackers can read profiler records exposing system and plugin configurations, secrets, request metadata, and queries. This could lead to data breaches, unauthorized access to sensitive information, and potential compromise of the Grav installation.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Disable the Clockwork profiler in Grav's configuration if not needed. Restrict access to Grav's debug endpoints via firewall rules. Ensure no HTTP proxies are running on the same host as Grav. Monitor for unusual access to /_profiler/ paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109325. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart