← Back

CVE-2025-66306

nvd nist
Published: Dec 1, 2025Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS Admin Panel which allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin email addresses and other metadata can be exposed, increasing the risk of phishing, credential stuffing, and social engineering. This vulnerability is fixed in 1.8.0-beta.27.

Affected (27)

Products: Getgrav: Grav
Getgrav
1 product
Grav
Configuration A
27 vulnerable
Vulnerable SoftwareAffected Versions
Getgrav
Grav
From 1.7.48 to 1.8.0
Grav
Version 1.8.0 beta10
Grav
Version 1.8.0 beta11
Grav
Version 1.8.0 beta12
Grav
Version 1.8.0 beta13
Grav
Version 1.8.0 beta14
Grav
Version 1.8.0 beta15
Grav
Version 1.8.0 beta16
Grav
Version 1.8.0 beta17
Grav
Version 1.8.0 beta18
Grav
Version 1.8.0 beta19
Grav
Version 1.8.0 beta1
Grav
Version 1.8.0 beta20
Grav
Version 1.8.0 beta21
Grav
Version 1.8.0 beta22
Grav
Version 1.8.0 beta23
Grav
Version 1.8.0 beta24
Grav
Version 1.8.0 beta25
Grav
Version 1.8.0 beta26
Grav
Version 1.8.0 beta2
Grav
Version 1.8.0 beta3
Grav
Version 1.8.0 beta4
Grav
Version 1.8.0 beta5
Grav
Version 1.8.0 beta6
Grav
Version 1.8.0 beta7
Grav
Version 1.8.0 beta8
Grav
Version 1.8.0 beta9

Related CWEs

CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (3)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
ExploitVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitVendor Advisory

Timeline

No history available yet.