CVE-2025-66306 MEDIUM

CVE-2025-66306: Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel

Vendor Getgrav
Product grav
Weakness CWE-639 · IDOR
Published December 1, 2025
Last update December 2, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS Admin Panel which allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin email addresses and other metadata can be exposed, increasing the risk of phishing, credential stuffing, and social engineering. This vulnerability is fixed in 1.8.0-beta.27.

Key dates

02Disclosure timeline

December 1, 2025 CVE published
December 2, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-49334 WordPress MyD Delivery plugin <= 1.7.1 - Insecure Direct Object References (IDOR) vulnerability CVE-2025-0987 IDOR in CB Project's CVLand CVE-2025-49978 WordPress JobSearch plugin < 3.0.6 - Insecure Direct Object References (IDOR) Vulnerability CVE-2024-10787 LA-Studio Element Kit for Elementor <= 1.4.4 - Authenticated (Contributor+) Post Disclosure CVE-2025-69032 WordPress FiveStar theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability