Executive brief
Grav is a flat-file content management system used to build websites. When the debug profiler is enabled, an attacker can access sensitive system information without authentication—including session cookies, login credentials, API keys, and SMTP passwords stored in plain text. This allows attackers to impersonate administrators or steal credentials used to operate the site.
Technical details
The vulnerability is an authentication bypass in the Clockwork debugger endpoint /__clockwork/. The InitializeProcessor::handleDebuggerRequest() method intercepts requests to this path during bootstrap without performing user authentication, IP restrictions, or Clockwork authenticator validation. When the debugger is enabled (disabled by default), the endpoint exposes the profiler's complete history with full request/response data. The stored records contain raw cookies (including Grav's session identifier), plaintext passwords from login forms, and system configuration including secrets, API keys, and licence credentials. Authorization headers are also exposed even when censored mode is enabled. Attack vector is network-based, requiring only that the debugger be enabled on the target system. Fixed in versions 1.7.53.4 and 2.0.22 by restricting the endpoint to localhost-only requests or requiring a new system.debugger.token secret, and by filtering cookies and credential headers from records.
Affected products
- Grav Grav 1.7.0 through 1.7.53.2, 2.0.0 through 2.0.21
Timeline
- 2026-09-17: disclosed: CVE-2026-92916 published
- 2026-09-17: patched: Fixed in Grav 1.7.53.4 and 2.0.22