Grav CMS CVE-2026-92916

Requires the Grav debugger to be explicitly turned on (system.debugger.enabled: true), which is NOT the default configuration - this is the primary limiting factor and most likely present on dev/staging or misconfigured production sites. When enabled, no authentication, user interaction, or special privileges are needed: the attacker simply requests any path containing /__clockwork/ over the network against a vulnerable Grav 1.7.0-1.7.53.2 or 2.0.0-2.0.21 install. The shipped censored: false default is what exposes cookies, request bodies, and config; note that Authorization and X-API-Token headers are disclosed even with censored: true, and on Grav 2.0 setting provider: debugbar does NOT mitigate because Clockwork is forced for JSON-preferring requests.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H, base 8.7) rates this HIGH: once reachable, exploitation is network-based, low-complexity, unauthenticated, and yields high confidentiality impact (VI:N/VA:N - no integrity/availability). However, the single most important limiting signal is in the description, not the vector: the vulnerable /__clockwork/ endpoint is only exposed when system.debugger.enabled: true, which is explicitly NOT the default. This is a deployment/config gate that the CVSS vector arguably under-weights (a defensible CVSS 4.0 AT:P). No EPSS score, no CISA KEV listing, and no public POC are present in the input - so there is no evidence of active exploitation or automated weaponization. Net: this is a genuinely serious confidentiality flaw (session cookies, plaintext admin passwords, and stored SMTP/API/licence secrets are exposed) that in practice chains to full admin takeover, but real-world risk is bounded to the subset of Grav installs running with the debugger deliberately enabled - typically dev/staging or misconfigured production. Treat as high priority for any environment with debugging on; lower priority for default installs. Note the vendor scored this confidentiality-only despite the practical escalation to account takeover via disclosed credentials - the downstream integrity impact is real but not reflected in the base score.

An attacker who discovers a Grav 1.7.x/2.0.x site running with the debugger enabled requests /__clockwork/ (and paginates the stored history) with no authentication, retrieving profiled records that contain victims' raw session cookies, plaintext login-form passwords, and the full site/plugin configuration. The attacker replays a captured admin session cookie (the PHP session id) or the disclosed admin password to log in as administrator, and harvests stored SMTP credentials, third-party API keys, and licence keys. No public exploit code is identified at time of analysis, but the attack is a trivial series of unauthenticated HTTP GETs.