Grav CMS versions starting at 1.7.53.3 and up to but excluding 1.7.53.6 contain a flaw in Debugger::isDebuggerRequestAuthorized. The check incorrectly permits requests that use the loopback address via a REMOTE_ADDR fallback, allowing an unauthenticated visitor to access the /__clockwork/ profiler endpoint. The profiler data can include administrators' plaintext passwords, configuration credentials, and other sensitive information, enabling an attacker to exfiltrate private data without authorization.

Affected products are Grav, the open‑source content‑management system from getgrav. The vulnerability exists in Grav releases 1.7.53.3, 1.7.53.4, and 1.7.53.5. The listed CPE applies to all supported platforms for these releases.

The CVSS base score is 8.7, indicating a high‑severity vulnerability. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog. The vulnerability can be exploited from an HTTP request targeting the /__clockwork/ path. The attack is more likely to succeed when the site operates behind a reverse proxy that maps external traffic to a loopback address, allowing an attacker to satisfy the loopback REMOTE_ADDR condition and read the stored profiling data. An attacker who can send arbitrary requests to the web application can therefore read sensitive configuration and password data without needing any authentication.