CVE-2026-92916: Grav CMS unauthenticated Clockwork profiler information disclosure

CVE-2026-92916 · Severity: high · CVSS 7.5 · Published 2026-09-17

Grav is a flat-file content management system used to build websites. When the debug profiler is enabled, an attacker can access sensitive system information without authentication—including session cookies, login credentials, API keys, and SMTP passwords stored in plain text. This allows attackers to impersonate administrators or steal credentials used to operate the site.

Technologies: Grav. Vendors: Grav.

Quick answers

Is CVE-2026-92916 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-92916 being exploited in the wild.
How severe is CVE-2026-92916?
High severity, with a CVSS score of 7.5, published 17 September 2026.
Which products and versions are affected?
Grav 1.7.0 through 1.7.53.2, 2.0.0 through 2.0.21.
Is there a fix for CVE-2026-92916?
A patch was published on 2026-09-17: Fixed in Grav 1.7.53.4 and 2.0.22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92916 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-92916?
Check whether you run Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass in the Clockwork debugger endpoint /__clockwork/. The InitializeProcessor::handleDebuggerRequest() method intercepts requests to this path during bootstrap without performing user authentication, IP restrictions, or Clockwork authenticator validation. When the debugger is enabled (disabled by default), the endpoint exposes the profiler's complete history with full request/response data. The stored records contain raw cookies (including Grav's session identifier), plaintext passwords from login forms, and system configuration including secrets, API keys, and licence credentials. Authorization headers are also exposed even when censored mode is enabled. Attack vector is network-based, requiring only that the debugger be enabled on the target system. Fixed in versions 1.7.53.4 and 2.0.22 by restricting the endpoint to localhost-only requests or requiring a new system.debugger.token secret, and by filtering cookies and credential headers from records.

Affected products

  • Grav Grav 1.7.0 through 1.7.53.2, 2.0.0 through 2.0.21

Timeline

  • 2026-09-17: disclosed: CVE-2026-92916 published
  • 2026-09-17: patched: Fixed in Grav 1.7.53.4 and 2.0.22

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.