Grav CMS EUVD-2025-200104

Requires an authenticated low-privilege (0-privilege) account on the Grav Admin Panel. The attacker requests another user's account page at /admin/accounts/users/{username} (e.g. /admin/accounts/users/admin); even though the endpoint returns HTTP 403 Forbidden, the target's email address is rendered in the <title> tag of the response body (from the user-accounts.yaml flex blueprint template). Limiting factors: exploitation is gated on holding a valid admin-panel login, the admin interface must be reachable by the attacker, and impact is confined to disclosure of email/metadata - no account takeover, write, or code execution. Affects Grav prior to 1.8.0-beta.27.

This is a genuine but low-to-moderate priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5 Medium) describes a network-reachable, low-complexity flaw requiring a low-privilege authenticated account, with confidentiality-only impact. The C:H rating is generous: per the GHSA advisory the leaked data is limited to admin email addresses and account metadata surfaced in the HTTP response <title> tag, which is closer to C:L than C:H - a realistic base score is ~4.3 rather than 6.5. Corroborating signals point to low real-world urgency: EPSS is 0.04% (13th percentile), the CVE is NOT in CISA KEV, and there is no evidence of active exploitation. Publicly available exploit code exists (the GHSA advisory documents a full PoC plus a PoC video), so the barrier to reproduction is trivial, but this is distinct from active in-the-wild exploitation. Net: a real, easily-reproduced authorization flaw whose impact is metadata information disclosure, not account takeover or code execution.

A low-privilege (0-privilege) authenticated user of the Grav Admin Panel requests another user's account endpoint (e.g. GET /admin/accounts/users/admin); although the server returns HTTP 403 Forbidden, the target admin's email address is still embedded in the response's <title> tag. Publicly available exploit code exists (documented PoC plus PoC video in the GHSA advisory), so any attacker with a low-privilege login can harvest admin emails and metadata to fuel targeted phishing, credential stuffing, or social engineering.