CVE-2026-117604: Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /clockwork/ profiler data via a loopback REMOTEADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 1.7.53.6
Event History
Frequently Asked Questions
Which deployments are realistically exposed to remote exploitation?
Grav installations from 1.7.53.3 before 1.7.53.6 are exposed when they are behind a reverse proxy on the same host, because remote requests can be presented to Grav with a loopback REMOTE_ADDR.
What does an attacker need to exploit this issue?
No authentication, user interaction, or special privileges are required. An attacker needs network access to the affected Grav instance and the ability to request the /__clockwork/ profiler endpoint through the same-host reverse-proxy arrangement.
What information could be disclosed?
Attackers can read stored Clockwork profiler records. Those records may include administrator plaintext passwords and configuration credentials.
How can I determine whether my instance is affected?
Check whether the Grav version is 1.7.53.3 through 1.7.53.5 and whether it is deployed behind a reverse proxy running on the same host. Also determine whether /__clockwork/ is reachable by unauthenticated requests and whether profiler records contain sensitive data.
What can be done if upgrading is not immediately possible?
Restrict unauthenticated access to /__clockwork/ at the reverse proxy or web-server layer, particularly for externally reachable traffic. Treat any credentials stored in accessible profiler records as potentially exposed and rotate them as appropriate.