Grav CVE-2025-66304

Requires an authenticated Grav admin-panel account that has been granted READ access to the user account management section (a privileged, non-default delegation). With that access the attacker simply views the user profile page and reads the bcrypt hash embedded in the page source - no additional exploit needed for disclosure. What LIMITS exploitation: (1) the privileged read grant on user accounts must exist, so it is not exploitable by anonymous or ordinary front-end users; (2) actual privilege escalation additionally requires successfully offline-cracking a bcrypt hash, which may be infeasible for a strong admin password. Affects Grav prior to 1.8.0-beta.27; fixed in 1.8.0-beta.27.

This is a genuine but distinctly non-critical issue whose real-world risk sits below its NVD score. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2) is inconsistent with the actual defect: the vulnerability directly exposes bcrypt password hashes to an already-authenticated admin-panel user who holds read access to user account management (PR:H). The claimed I:H/A:H are speculative - integrity/availability impact only materializes if an attacker successfully offline-cracks a bcrypt hash, which is not guaranteed and is itself a high-complexity step. The vendor's own GHSA rating (6.2, AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L) is more honest about complexity by using AC:H, though it still assigns downstream I/A impact. The certain, direct impact is confidentiality (C:H). Exploitation signals reinforce a low-urgency picture: EPSS is only 0.08% (23rd percentile), there is no CISA KEV listing, and while PoC steps exist in the X41/GitHub advisory, PoC availability is not active exploitation. The dominant limiting factor is PR:H - an attacker must first possess a Grav admin account with user-management read rights, which is a privileged, non-default grant. Net: a real integrity/hygiene fix worth applying, but not an emergency; effective exploitation is gated behind privileged access AND successful bcrypt cracking.

A Grav operator delegates limited admin-panel access to a lower-trust user, granting read permission on the user account management section. That user opens the admin profile page (e.g. /admin/accounts/users/admin), inspects the raw page source, and recovers every user's bcrypt password hash including the administrator's, as demonstrated in the publicly available X41 D-Sec proof-of-concept in GHSA-gq3g-666w-7h85. They then run an offline cracking tool against the admin hash and, if it cracks, log in as full administrator.