CVE-2025-66307

MediumCVSS 6.5

Published: 01/12/2025(UTC)Updated: 26/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

22th percentile - higher than 22% of all known CVEs

Summary

The admin plugin for Grav (prior to 1.11.0-beta.1) contains a user enumeration and email disclosure vulnerability. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This vulnerability is fixed in 1.11.0-beta.1.

Risk Assessment

An attacker could gather a list of valid usernames and email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering. The risk affects all Grav installations with this plugin.

Recommendation

Update the Grav admin plugin to version 1.11.0-beta.1 or later. Until then, monitor for user enumeration attempts.

Other vulnerabilities in Grav admin plugin

CVE-2025-66311Medium
The admin plugin for Grav (an HTML user interface for configuring Grav and editing pages) contains a Stored Cross-Site Scripting (XSS) vulnerability in the /admin/pages/[page] endpoint. Attackers can inject malicious scripts into the data[header][metadata], data[header][taxonomy][category], and data[header][taxonomy][tag] parameters, which are stored in the page frontmatter and executed whenever the page is accessed or rendered in the administrative interface. The vulnerability is fixed in version 1.11.0-beta.1.

Original NVD description (English source)

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering. This vulnerability is fixed in 1.11.0-beta.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS