Which versions of Grav Admin2 are affected by CVE-2026-61454?

The Grav Admin2 plugin exposes critical system configuration details-including exact version numbers, server URLs, and API endpoints-to any unauthenticated visitor, enabling attackers to precisely…. A patch is available.

How to fix or mitigate CVE-2026-61454?

24 hours: Inventory all Grav installations running the Admin2 plugin and document current versions; review access logs to /grav/admin for suspicious reconnaissance activity. 7 days: Implement firewall or reverse proxy restrictions limiting /grav/admin access to trusted IP addresses only; disable the Admin2 plugin entirely if not actively required for operations. 30 days: Deploy Web Application Firewall rules to monitor and block suspicious /grav/admin requests; establish continuous monitoring for exploitation attempts; evaluate alternative admin solutions for long-term risk mitigation.

Grav Admin2 CVE-2026-61454

Q: What is the CVSS score of CVE-2026-61454?

CVE-2026-61454 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43184 HIGH

Information Exposure (CWE-200)

2026-07-11 VulnCheck

GHSA-q4j8-3jf6-pjvp

Information Disclosure Grav Getgrav

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Unauthenticated network GET with no interaction (AV:N/AC:L/PR:N/UI:N); impact is limited to disclosure of version/path metadata, so C:L with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 11, 2026 - 15:01 EUVD

Analysis Generated

Jul 11, 2026 - 13:51 vuln.today

DescriptionCVE.org

The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin (and its subroutes). This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers, allowing an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without reconnaissance.

AnalysisAI

Information disclosure in the Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 exposes a window.__GRAV_CONFIG__ JavaScript object on the /grav/admin SPA bootstrap page and its subroutes, leaking exact Grav and Admin2 version numbers, server URL, API prefix, admin base path, and runtime environment to any unauthenticated visitor. Reported by VulnCheck, the flaw lets remote unauthenticated attackers fingerprint a deployment and pre-select version-specific exploits with zero active reconnaissance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Grav is a flat-file PHP CMS, and Admin2 is its next-generation single-page administration interface. During SPA bootstrap the server inlines a global configuration object (window.__GRAV_CONFIG__) into the HTML delivered at /grav/admin, a common pattern for hydrating front-end frameworks with runtime settings. The defect is that this object is emitted in EVERY response - including those served to unauthenticated clients - and includes precise version strings for both Grav and the Admin2 plugin plus internal path/API metadata. This maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): sensitive deployment metadata that should be gated behind authentication is disclosed in a pre-auth code path. The CPE cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* identifies the affected software as Grav itself, though the vulnerable component is specifically the Admin2 plugin.

RemediationAI

Vendor-released patch: upgrade the Grav Admin2 plugin to version 2.0.4 or later, which is the primary and confirmed fix (see GHSA-pfjq-chp8-3vgh at https://github.com/getgrav/grav/security/advisories/GHSA-pfjq-chp8-3vgh). If immediate upgrade is not possible, restrict access to the /grav/admin path and its subroutes at the reverse proxy or web server so the SPA bootstrap page is only reachable from trusted management networks or VPN - this blocks unauthenticated fingerprinting but also prevents legitimate remote administrators from reaching the console until whitelisted. As an alternative compensating control, place the admin interface behind an authenticating proxy (HTTP basic auth or SSO) so the config object is never served pre-auth; the trade-off is added login friction and configuration overhead. Do not rely on obscuring version strings alone, as the object also leaks API prefix and admin base path. Confirm remediation via the VulnCheck advisory at https://www.vulncheck.com/advisories/grav-before-information-disclosure-via-grav-config.