CVE-2026-100672: grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

Q: Which Grav deployments are exposed?

Deployments using the classic Admin plugin with the Comments plugin enabled are affected; this is the default configuration described. Sites using the Grav 2.0 Admin Next stack with admin2 and api are not affected through this endpoint.

Q: Does an attacker need an account or any user interaction?

No. An unauthenticated remote attacker can request the affected admin comments endpoint directly, with no credentials or user interaction required.

Q: What information can be disclosed?

The endpoint can return every comment from the preceding 7 days, including commenters' email addresses and the absolute server filesystem path of the data file.

Q: How can I tell whether the issue is currently exploitable?

On a site using classic Admin and Comments, an unauthenticated request to /admin/comments/page:<n>, such as /admin/comments/page:0.001, can return comment data as JSON if the vulnerable handler is reachable.

Published Sep 26, 2026

Updated

The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the admin service is registered on the current route rather than that the visitor is authenticated, and it echoes the JSON and calls exit() during the plugins stage, before the classic Admin plugin would render its login screen. On a site using the classic Admin plugin with Comments enabled (the default), an unauthenticated remote attacker can request /admin/comments/page:<n> (e.g. page:0.001) and retrieve every comment from the last 7 days, including each commenter's email address and the absolute server filesystem path of the data file. Sites running the Grav 2.0 Admin Next stack (admin2 + api) are not affected via this path. The issue is fixed in 1.2.11, which requires an authenticated user with admin.comments or admin.super and removes the absolute filePath from the response.

Affected Software

1 affected component

Grav Comments plugin<1.2.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade getgrav/grav-plugin-comments to a version that resolves this vulnerability.
Fixed in 1.2.11

Event History

Sep 26, 2026

CVE Published

via MITRE·01:23 PM

Data Sourced

via MITRE·01:23 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Grav deployments are exposed?

Deployments using the classic Admin plugin with the Comments plugin enabled are affected; this is the default configuration described. Sites using the Grav 2.0 Admin Next stack with admin2 and api are not affected through this endpoint.

Does an attacker need an account or any user interaction?

No. An unauthenticated remote attacker can request the affected admin comments endpoint directly, with no credentials or user interaction required.

What information can be disclosed?

The endpoint can return every comment from the preceding 7 days, including commenters' email addresses and the absolute server filesystem path of the data file.

How can I tell whether the issue is currently exploitable?

On a site using classic Admin and Comments, an unauthenticated request to /admin/comments/page:<n>, such as /admin/comments/page:0.001, can return comment data as JSON if the vulnerable handler is reachable.

What is the available remediation?

Upgrade the Comments plugin to version 1.2.11. The fixed version requires an authenticated user with admin.comments or admin.super and removes the absolute filePath from the response.