Grav from version 2.0.22 up to (but not including) 2.1.7 contains a flaw that allows page editors to expose the Clockwork debugger token. The sandbox redaction list in the vulnerable versions does not include system.debugger.token, so editors can render the token via Twig. Once the token is obtained, an attacker can supply it as the X-Clockwork-Auth header to access profiler records, which include configuration, request metadata, and database queries, effectively leaking sensitive application data.

The affected product is Grav, version 2.0.22 through 2.1.6, provided by getgrav. No other vendors or product lines are listed as impacted.

Based on the description, it is inferred that the vulnerability requires an attacker already to have the ability to edit pages, indicating a privileged editorial access requirement. The CVSS score of 7.1 indicates a medium‑to‑high severity, and the EPSS score is not available and the issue is not listed in the CISA KEV catalog. Once the token is exposed, an attacker can read all profiler data—including configuration secrets and database queries—which could aid further attacks or compromise security parameters. Because the attack vector relies on privileged editorial access rather than remote code execution or arbitrary user input, it is inferred that the exploitation risk is limited to environments where editors can inject or view content.