CVE-2025-66307
published 2025-12-01CVE-2025-66307: This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.28%
19.4th percentile
This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering. This vulnerability is fixed in 1.11.0-beta.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getgrav | grav | < 1.11.0-beta.1 | 1.11.0-beta.1 |
| getgrav | grav | >= 0 < 1.8.0-beta.27 | 1.8.0-beta.27 |
| getgrav | grav-plugin-admin | <= 1.10.50 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
ghsa·2025-12-02
CVE-2025-66307 [MEDIUM] CWE-204 Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
# Grav v1.7.49.5 / Admin v1.10.49.1 – User Enumeration & Email Disclosure
### Summary
A **user enumeration and email disclosure vulnerability** exists in Grav **v1.7.49.5** with Admin plugin **v1.10.49.1**.
The "Forgot Password" functionality at `/admin/forgot` leaks information about valid usernames and their associated email addresses through distinct server responses.
This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering.
### Details
The issue resides in the [`taskForgot()`](https://github.com/getgrav/grav-plugin-admin/blob/6d673fc7c4f6962756f93ae651371e81f7f20924/classes/plugin/Control
OSV
Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
osv·2025-12-02
CVE-2025-66307 [MEDIUM] Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
# Grav v1.7.49.5 / Admin v1.10.49.1 – User Enumeration & Email Disclosure
### Summary
A **user enumeration and email disclosure vulnerability** exists in Grav **v1.7.49.5** with Admin plugin **v1.10.49.1**.
The "Forgot Password" functionality at `/admin/forgot` leaks information about valid usernames and their associated email addresses through distinct server responses.
This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering.
### Details
The issue resides in the [`taskForgot()`](https://github.com/getgrav/grav-plugin-admin/blob/6d673fc7c4f6962756f93ae651371e81f7f20924/classes/plugin/Control
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-12-01
Published