Grav Admin2 EUVD-2026-43184

Exploitation requires only that the Grav Admin2 plugin (version before 2.0.4) is installed and its administration SPA is network-reachable at /grav/admin or a subroute; the sensitive window.__GRAV_CONFIG__ object is returned in every unauthenticated response by default, so no special feature toggle or non-default configuration is needed. No special conditions - remote unauthenticated exploitation against default configurations of the Grav Admin2 plugin. The primary limiting factor is exposure: if /grav/admin is not internet-reachable (e.g., bound to localhost, IP-restricted, or behind a VPN/authenticating proxy), an external attacker cannot retrieve the object. Impact is also limited to information disclosure - it enables follow-on attacks rather than directly compromising the system.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) scores 8.7 (High), reflecting trivial, unauthenticated, network-reachable exploitation. However, the actual impact is confidentiality of deployment metadata (version numbers, paths, environment type) - not sensitive user or business data - so the VC:H rating appears aggressive; a Low confidentiality impact is more defensible, which is why this analyst's independent assessment scores it substantially lower. No EPSS score, KEV listing, or POC was provided: there is no public exploit identified at time of analysis and no evidence of active exploitation. The genuine risk is not the disclosure itself but its role as a force-multiplier - it removes the reconnaissance step attackers normally need to match a target to a version-specific exploit, meaningfully shortening the time-to-exploit for any future Grav/Admin2 vulnerability. Treat this as a reconnaissance-enabling hardening issue rather than a standalone critical, high-CVSS-but-lower-real-risk in isolation.

An unauthenticated attacker scanning the internet requests /grav/admin, reads the inlined window.__GRAV_CONFIG__ object from the returned HTML, and extracts the exact Grav and Admin2 version numbers plus internal paths. They cross-reference those versions against known CVEs and immediately launch a matching version-specific exploit, skipping the trial-and-error probing that would otherwise generate noise and delay. No POC is currently published, but exploitation requires only a single unauthenticated HTTP GET (AV:N/AC:L/PR:N).