What’s Vulnerable › Vulnerabilities

CVE-2025-66307: Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-01 · updated 2026-09-26
• Weakness: CWE-204

Description

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering. This vulnerability is fixed in 1.11.0-beta.1.

Affected products

• getgrav grav-plugin-admin: through 1.10.50

References

• https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0
• https://github.com/getgrav/grav/security/advisories/GHSA-q3qx-cp62-f6m7
• https://github.com/getgrav/grav/security/advisories/GHSA-q3qx-cp62-f6m7

Get alerted when CVE-2025-66307 or the next vulnerability affects your stack