6.5

CVE-2025-66306

Exploit
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS Admin Panel which allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin email addresses and other metadata can be exposed, increasing the risk of phishing, credential stuffing, and social engineering. This vulnerability is fixed in 1.8.0-beta.27.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Getgrav ≫ Grav Version >= 1.7.48 < 1.8.0
Getgrav ≫ Grav Version1.8.0 Updatebeta1
Getgrav ≫ Grav Version1.8.0 Updatebeta10
Getgrav ≫ Grav Version1.8.0 Updatebeta11
Getgrav ≫ Grav Version1.8.0 Updatebeta12
Getgrav ≫ Grav Version1.8.0 Updatebeta13
Getgrav ≫ Grav Version1.8.0 Updatebeta14
Getgrav ≫ Grav Version1.8.0 Updatebeta15
Getgrav ≫ Grav Version1.8.0 Updatebeta16
Getgrav ≫ Grav Version1.8.0 Updatebeta17
Getgrav ≫ Grav Version1.8.0 Updatebeta18
Getgrav ≫ Grav Version1.8.0 Updatebeta19
Getgrav ≫ Grav Version1.8.0 Updatebeta2
Getgrav ≫ Grav Version1.8.0 Updatebeta20
Getgrav ≫ Grav Version1.8.0 Updatebeta21
Getgrav ≫ Grav Version1.8.0 Updatebeta22
Getgrav ≫ Grav Version1.8.0 Updatebeta23
Getgrav ≫ Grav Version1.8.0 Updatebeta24
Getgrav ≫ Grav Version1.8.0 Updatebeta25
Getgrav ≫ Grav Version1.8.0 Updatebeta26
Getgrav ≫ Grav Version1.8.0 Updatebeta3
Getgrav ≫ Grav Version1.8.0 Updatebeta4
Getgrav ≫ Grav Version1.8.0 Updatebeta5
Getgrav ≫ Grav Version1.8.0 Updatebeta6
Getgrav ≫ Grav Version1.8.0 Updatebeta7
Getgrav ≫ Grav Version1.8.0 Updatebeta8
Getgrav ≫ Grav Version1.8.0 Updatebeta9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.04% 0.128
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
security-advisories@github.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.