CVE-2026-61454: Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__
The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.GRAVCONFIG in the Admin2 SPA bootstrap page at /grav/admin (and its subroutes). This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers, allowing an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without reconnaissance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-admin2to a version that resolves this vulnerability.Fixed in 2.0.4 - Configuration
Modify the Admin2 SPA bootstrap page under /grav/admin (and subroutes) so unauthenticated responses no longer embed the global JavaScript variable window.__GRAV_CONFIG__ that discloses server URL, API prefix, admin base path, runtime environment type, and exact Grav/Admin2 version numbers.
Grav Admin2 plugin window.__GRAV_CONFIG__ embedding = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61454?
CVE-2026-61454 has a medium severity score of 5.3.
What does CVE-2026-61454 exploit?
CVE-2026-61454 exploits an information disclosure vulnerability in the Grav Admin2 plugin before version 2.0.4.
How does CVE-2026-61454 affect users?
CVE-2026-61454 can lead to unauthorized exposure of sensitive configuration details through the global JavaScript variable window.__GRAV_CONFIG__.
How do I fix CVE-2026-61454?
To fix CVE-2026-61454, update the Grav Admin2 plugin to version 2.0.4 or later.
What is the impact of not addressing CVE-2026-61454?
Not addressing CVE-2026-61454 could result in an attacker gaining unauthorized access to sensitive server information.