CVE-2025-66307

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66307
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66307.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66307
Aliases
Published
2025-12-01T21:53:43.510Z
Modified
2026-04-10T05:35:08.147055Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
Summary
Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
Details

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering. This vulnerability is fixed in 1.11.0-beta.1.

Database specific 
{
    "cwe_ids": [
        "CWE-204"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66307.json"
}
References

Affected packages

Git / github.com/getgrav/grav-plugin-admin

Affected ranges

Type
GIT
Repo
https://github.com/getgrav/grav-plugin-admin
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
831fb2641450bfc8ba5f991cdca44c86eb9e58f9

Affected versions

1.*
1.1.0-beta.1
1.1.0-beta.2
1.1.0-beta.3
1.1.0-beta.4
1.1.0-beta.5
1.1.0-rc.1
1.1.0-rc.2
1.1.0-rc.3
1.1.0-rc.4
1.10.0-beta.1
1.10.0-beta.10
1.10.0-beta.2
1.10.0-beta.3
1.10.0-beta.4
1.10.0-beta.5
1.10.0-beta.6
1.10.0-beta.7
1.10.0-beta.8
1.10.0-beta.9
1.10.0-rc.1
1.10.0-rc.10
1.10.0-rc.11
1.10.0-rc.12
1.10.0-rc.13
1.10.0-rc.14
1.10.0-rc.15
1.10.0-rc.16
1.10.0-rc.17
1.10.0-rc.18
1.10.0-rc.19
1.10.0-rc.2
1.10.0-rc.20
1.10.0-rc.3
1.10.0-rc.4
1.10.0-rc.5
1.10.0-rc.6
1.10.0-rc.7
1.10.0-rc.8
1.10.0-rc.9
1.2.0-rc.1
1.2.0-rc.2
1.2.12
1.2.13
1.2.14
1.2.5-rc.1
1.2.5-rc.2
1.2.5-rc.3
1.2.5-rc.4
1.3.0
1.3.1
1.3.2
1.3.3
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.7.0
1.7.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66307.json"