{"schema":"threatline.record/2","record":{"id":"CVE-2026-117604","aliases":["GHSA-xprx-c7jf-cp6g"],"summary":"Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback","details":"Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.","categories":["Unclassified"],"product":"grav","vendor":"getgrav","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117604","source_modified_at":"2026-10-27T14:39:10.858Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"grav","vendor":"getgrav","versions":[{"version":"1.7.53.3","status":"affected","versionType":"custom","lessThan":"1.7.53.6"},{"version":"1.7.53.6","status":"unaffected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117604","source_modified_at":"2026-10-27T14:39:10.858Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"grav","ecosystem":null},"version":"1.7.53.6","basis":"first unaffected version stated in the CVE record"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T14:39:10.858Z","modified_at":"2026-10-27T14:39:10.858Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-117604","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T14:39:10.858Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/getgrav/grav/security/advisories/GHSA-xprx-c7jf-cp6g","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/getgrav/grav/commit/4d9fca043f990a818d65cea61c928203b9e19641","tags":["patch"]},{"source":"CVE List","url":"https://github.com/getgrav/grav/releases/tag/1.7.53.6","tags":["release-notes"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/grav-from-1.7.53.3-before-1.7.53.6-clockwork-profiler-authorization-bypass-via-loopback-fallback","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T14:39:10.858Z","content_hash":"258d0a93933302b69957ac6a1e23ea61ff053df3c9957bc40abc2f4fea4640f0"}}