Overview
CVE-2025-66307 is a medium severity vulnerability affecting the Admin Plugin for Grav CMS. This vulnerability allows attackers to enumerate valid usernames and disclose associated email addresses. The issue stems from the “Forgot Password” functionality, where distinct server responses reveal whether a provided username exists within the system.
Technical Details
The vulnerability resides in the /admin/forgot endpoint of the Grav Admin Plugin. By sending requests to this endpoint with different usernames, an attacker can analyze the server’s response. A positive response (e.g., indicating that a password reset email has been sent or queued) confirms the existence of the username and its associated email address. A negative response (e.g., indicating an invalid username) confirms the username’s absence. This behavior facilitates user enumeration and email harvesting.
Prior to version 1.11.0-beta.1, the application failed to properly sanitize responses to the ‘Forgot Password’ request, resulting in the information disclosure.
CVSS Analysis
The vulnerability has a CVSS score of 6.5 (Medium).
Possible Impact
Successful exploitation of CVE-2025-66307 can have significant consequences:
- User Enumeration: Attackers can create a list of valid usernames registered on the Grav CMS instance.
- Email Disclosure: The email addresses associated with enumerated usernames are revealed.
- Targeted Attacks: The disclosed information can be used for targeted attacks, including:
- Password Spraying: Trying common passwords against the enumerated usernames.
- Phishing Campaigns: Crafting convincing phishing emails using the revealed email addresses.
- Social Engineering: Using the information to manipulate users into divulging sensitive information.
Mitigation and Patch Steps
The vulnerability has been fixed in Grav Admin Plugin version 1.11.0-beta.1. Administrators are strongly advised to upgrade to this version or a later release as soon as possible.
- Upgrade Grav Admin Plugin: Update to version 1.11.0-beta.1 or later through the Grav Admin Panel or using the Grav Package Manager (GPM).
- Monitor for Suspicious Activity: Keep an eye on server logs for unusual activity related to the
/admin/forgotendpoint.
