CVE-2026-92916 getgrav CVE debrief

Who should care

Defenders and administrators of Grav CMS installations should assess exposure and apply patches or workarounds to prevent unauthorized access to sensitive information. This includes reviewing system configurations, verifying exposure, and applying patches or workarounds to prevent potential unauthorized access and session hijacking.

Why it matters

CVE-2026-92916 is a high-severity vulnerability in Grav CMS that allows unauthenticated access to sensitive information when the debugger is enabled. Defenders should prioritize verifying exposure and applying patches or workarounds to prevent potential unauthorized access and session hijacking.

• Potential unauthorized access to sensitive information including session cookies and system configuration
• Possible resumption of another user's session, including an authenticated admin's
• Exposure of operator-saved secrets such as SMTP credentials and third-party API keys

Technical summary

The Clockwork profiler endpoint in Grav CMS is exposed without authentication when the debugger is enabled, allowing access to sensitive information including session cookies, passwords, and system configuration. This issue arises from InitializeProcessor::handleDebuggerRequest() intercepting any path containing /__clockwork/ during bootstrap and passing it to Debugger::debuggerRequest(), which performs no user lookup, IP restriction, or Clockwork authenticator check. The issue is fixed in 1.7.53.4 and 2.0.22, which restrict /__clockwork/ to server-local requests or requests presenting the new system.debugger.token secret and strip cookies and credential headers from stored records.

Defensive priority

Defenders should prioritize verifying exposure and applying patches due to potential unauthorized access to sensitive information

Recommended defensive actions

• Verify if the debugger is enabled in the Grav configuration and disable it if not required.
• Restrict access to the /__clockwork/ endpoint at the web server or CDN level.
• Apply patches in versions 1.7.53.4 and 2.0.22 or later.
• Review and update system and plugin configurations, including operator-saved secrets.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Grav, a flat-file CMS, affecting versions 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21 when the debugger is enabled. Evidence is limited to public CVE and NVD records. Defenders should verify exposure by reviewing system configurations and applying patches or workarounds.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.