CVE-2026-100672 getgrav CVE debrief

Who should care

Defenders of Grav CMS installations with the Comments plugin enabled should assess exposure and prioritize upgrading to version 1.2.11 or later. They should verify if the Grav CMS Comments plugin version is 1.2.11 or later and restrict access to the /admin/comments endpoint.

Why it matters

CVE-2026-100672 allows unauthenticated remote attackers to retrieve comment data, including sensitive information, from Grav CMS installations with the Comments plugin enabled. Defenders should prioritize verifying exposure and upgrading to version 1.2.11 or later.

• Potential unauthorized access to sensitive comment data
• Possible exposure of email addresses and server filesystem paths
• Verification of exposure and remediation priority
• Potential impact on site security and data confidentiality

Technical summary

The Grav CMS Comments plugin through version 1.2.10 has an unauthenticated admin handler that returns comment data as JSON, allowing remote attackers to retrieve comments from the last 7 days, including email addresses and server filesystem paths. The issue is fixed in 1.2.11, which requires an authenticated user with admin.comments or admin.super and removes the absolute filePath from the response. Sites running the Grav 2.0 Admin Next stack (admin2 + api) are not affected via this path. The vulnerability allows unauthenticated remote attackers to request /admin/comments/page:<n> and retrieve every comment from the last 7 days.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to version 1.2.11 or later

Recommended defensive actions

• Verify if the Grav CMS Comments plugin version is 1.2.11 or later
• Restrict access to the /admin/comments endpoint
• Monitor for unauthorized access to comment data
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Verification of exposure and remediation is required. The vulnerability allows unauthenticated remote attackers to request /admin/comments/page:<n> and retrieve every comment from the last 7 days. The handler branches on isAdmin(), which only indicates that the admin service is registered on the current route rather than that the visitor is authenticated. On a site using the classic Admin plugin with Comments enabled (the default), an unauthenticated remote attacker is

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.