# CVE-2026-117604: Grav authorization bypass in Clockwork profiler debugger

Source: https://junglewise.ai/threats/cve-2026-117604-grav-from-1-7-53-3-before-1-7-53-6-contains-an-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-117604 · Severity: high · CVSS 7.5 · Published 2026-10-27

Grav is a flat-file content management system used to build websites. Versions 1.7.53.3 through 1.7.53.5 contain an authorization flaw in the Clockwork profiler that allows unauthenticated attackers to read sensitive debugging data, including plaintext administrator passwords and database credentials, when the server is behind a reverse proxy on the same host.

Technologies: [Getgrav Grav](https://junglewise.ai/threats/technologies/getgrav-grav-1). Vendors: [Getgrav](https://junglewise.ai/threats/vendors/getgrav).

## Quick answers

**Is CVE-2026-117604 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117604 being exploited in the wild.

**How severe is CVE-2026-117604?** High severity, with a CVSS score of 7.5, published 27 October 2026.

**Which products and versions are affected?** Getgrav Grav 1.7.53.3 before 1.7.53.6.

**Is there a fix for CVE-2026-117604?** Yes: fixed in 1.7.53.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-117604 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-117604?** Check whether you run Getgrav Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.7.53.6

## Technical details

The Debugger::isDebuggerRequestAuthorized() method incorrectly trusts the REMOTE_ADDR header to verify requests originating from localhost, allowing bypass of token authentication. When Grav runs behind a same-host reverse proxy, remote requests appear as loopback traffic, enabling attackers to access /__clockwork/ profiler records without credentials. The vulnerability requires no user interaction and is exploitable over the network in reverse-proxy environments.

## Affected products

- Getgrav Grav 1.7.53.3 before 1.7.53.6

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/getgrav/grav/commit/4d9fca043f990a818d65cea61c928203b9e19641](https://github.com/getgrav/grav/commit/4d9fca043f990a818d65cea61c928203b9e19641)
- [https://github.com/getgrav/grav/releases/tag/1.7.53.6](https://github.com/getgrav/grav/releases/tag/1.7.53.6)

## Related threats

- [Grav information disclosure via form config directives](https://junglewise.ai/threats/cve-2026-112781-grav-from-2-0-0-before-2-2-2-contains-an-information-disclosure)
- [Grav allowlist bypass in Flex form field renaming](https://junglewise.ai/threats/cve-2026-112780-grav-from-2-0-15-before-2-2-2-contains-an-allowlist-bypass)
- [Grav session cookie theft via Twig sandbox](https://junglewise.ai/threats/cve-2026-100671-grav-is-a-flat-file-cms-in-versions-2-0-19-through-2-0-24-and-in)
- [Grav sandbox escape via array filter](https://junglewise.ai/threats/cve-2026-100668-grav-2-0-0-through-2-0-24-contain-a-twig-content-sandbox-escape)
- [Grav may be vulnerable to SSRF attack via Twig Templates](https://junglewise.ai/threats/cve-2025-66844-grav-may-be-vulnerable-to-ssrf-attack-via-twig-templates)