CVE-2026-100672

Executive Summary

CVE-2026-100672 is an unauthenticated information disclosure vulnerability in the getgrav/grav-plugin-comments plugin for Grav CMS, affecting versions through 1.2.10. The plugin registers an admin handler that returns comment data as JSON without performing an authentication check, exposing up to seven days of comment content, commenter email addresses, and absolute server filesystem paths to any unauthenticated remote attacker. With a CVSS score of 7.5, this vulnerability represents a high-severity confidentiality breach affecting any Grav installation using the classic Admin plugin with the Comments plugin enabled (the default configuration).

Technical Analysis

The Comments plugin for Grav CMS registers a handler for the /admin/comments/ route that returns comment data in JSON format. The vulnerability stems from a fundamental logic error in the authentication mechanism: the handler branches on isAdmin(), which merely checks whether the admin service is registered on the current route, not whether the requesting visitor has been authenticated. This conflation of service availability with user authentication means the handler proceeds to serialize and return comment data even for anonymous visitors.

The handler echoes the JSON response and calls exit() during the plugins stage of Grav's request lifecycle. This execution timing is critical to the vulnerability: because the handler terminates execution before the classic Admin plugin renders its login screen, the authentication barrier that would normally protect admin routes is never reached. The login screen serves as the primary access control mechanism for admin functionality in classic Grav deployments, and by circumventing it through early termination, the plugin effectively bypasses all access controls.

An unauthenticated attacker can request /admin/comments/page:<n> — for example, /admin/comments/page:0.001 — to retrieve comments. The response includes not only the comment content itself but also each commenter's email address and the absolute server filesystem path of the data file storing the comments. The email addresses constitute personally identifiable information (PII), while the filesystem path disclosure provides valuable reconnaissance for follow-on attacks such as path traversal or local file inclusion.

Notably, sites running the Grav 2.0 Admin Next stack (admin2 + api) are not vulnerable through this specific attack path, likely because the newer stack implements a different authentication architecture that enforces authorization checks at a different layer. The vulnerability is specific to the classic Admin plugin implementation.

The root cause maps to CWE-306 (Missing Authentication for Critical Function), where a function that requires authentication to protect sensitive data is accessible without any authentication mechanism being enforced.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred from the vulnerability class and the technical details provided in the NVD description.

1) Reconnaissance and target identification An attacker identifies Grav CMS installations using search engines or Shodan via page content signatures such as /user/plugins/comments or the presence of Grav-specific HTML markers. The attacker confirms the target uses the classic Admin plugin and has the Comments plugin enabled — the default configuration for Grav sites with the classic admin stack.

2) Triggering the flaw The attacker sends an unauthenticated HTTP GET request to the admin comments endpoint using the pagination parameter syntax. For example, a request to /admin/comments/page:0.001 is dispatched to the plugin's admin handler. Because the handler checks only isAdmin() — which confirms the admin service is registered on the route rather than verifying visitor authentication — the authentication gate is never enforced.

3) Payload and execution No malicious payload is required. The handler processes the request during the plugins stage, serializes the comment dataset to JSON, writes the response to the output stream, and calls exit() before the classic Admin plugin's login screen can render. The attacker receives a JSON response containing up to seven days of comments, commenter email addresses, and the absolute filesystem path of the comment data file.

4) Post-exploitation impact The attacker obtains a dataset of PII (email addresses) associated with commenters, the full content of recent comments, and server filesystem path information. This data supports follow-on phishing campaigns targeting commenters, reconnaissance for path traversal or file inclusion attacks using the disclosed filesystem structure, and gathering of intelligence about the Grav deployment's internal organization. Because the vulnerability is unauthenticated and network-accessible with no user interaction required, it can be exploited at scale against a population of vulnerable targets.

Impact Assessment

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) yields a base score of 7.5, reflecting a high-severity vulnerability. The network attack vector (AV:N) indicates exploitation over the internet without local access. Low attack complexity (AC:L) means no special conditions are needed. No privileges are required (PR:N) and no user interaction is necessary (UI:N), making this trivially exploitable.

The confidentiality impact is High (C:H): attackers retrieve commenter email addresses (PII), comment content, and absolute server filesystem paths. The integrity and availability impacts are None (I:N/A:N) — the attacker cannot modify or delete data through this flaw.

Business impact includes regulatory exposure where commenter email addresses constitute PII under GDPR, CCPA, or similar frameworks. Organizations using Grav with the Comments plugin face potential notification obligations following confirmed exploitation. The disclosed filesystem paths increase the attack surface for chained vulnerabilities. The blast radius encompasses every Grav site running the classic Admin plugin with Comments enabled through version 1.2.10.

Detection Guidance

Sigma Rule

title: Grav Comments Plugin Unauthenticated Admin Data Access
id: 8f3c2a1e-4b5d-4e6f-9a7b-1c2d3e4f5a6b
status: experimental
description: Detects unauthenticated requests to the Grav Comments plugin admin handler that return comment data as JSON without authentication
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100672
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-100672
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|startswith: '/admin/comments/'
  selection_pagination:
    cs-uri-stem|contains: 'page:'
  selection_status:
    sc-status: 200
  selection_unauth:
    cs-username:
      - ''
      - '-'
  condition: selection_uri and selection_pagination and selection_status and selection_unauth
falsepositives:
  - Legitimate authenticated administrators viewing comments
level: high

YARA Rule

rule CVE_2026_100672_Grav_Comments_Unauth
{
    meta:
        description = "Detects Grav Comments plugin source vulnerable to unauthenticated admin handler access"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100672"
        date = "2026-01-01"
        severity = "high"

    strings:
        $a = "isAdmin" ascii
        $b = "filePath" ascii
        $c = "/admin/comments" ascii
        $d = "admin.comments" ascii

    condition:
        (uint16(0) == 0x3C3F or uint32(0) == 0x7068703C) and
        (2 of ($a, $b, $c, $d))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100672 Grav Comments Plugin Unauthenticated Admin Data Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/admin/comments/"; http.uri; content:"page:"; classtype:attempted-recon; reference:cve,2026-100672; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100672; sid:2026100672; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where http.request.method == "GET" and
      http.request.uri : "/admin/comments/*" and
      http.request.uri : "*page:*" and
      url.path : "/admin/comments/*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/admin/comments/*" uri_path="*page:*" status=200
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as request_paths by clientip, host
| where count >= 1
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,appsec,grav,">
  <rule id="100672" level="12">
    <if_sid>31100</if_sid>
    <url>/admin/comments/</url>
    <url>page:</url>
    <description>CVE-2026-100672 - Grav Comments plugin unauthenticated admin data access attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100672,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Disable the Comments plugin on all Grav installations running the classic Admin plugin until the plugin can be upgraded. This eliminates the vulnerable attack path entirely.
• If Comments functionality is required, restrict access to /admin/comments/ at the reverse proxy or WAF layer, denying requests that lack authenticated session cookies.
• Block or alert on URI patterns matching /admin/comments/page: from unauthenticated sources.
• Treat all commenter email addresses collected during the exposure window as potentially compromised and assess regulatory notification obligations.

2) Patch/upgrade steps

• Upgrade getgrav/grav-plugin-comments to version 1.2.11, which requires an authenticated user with admin.comments or admin.super privileges and removes the absolute filePath from the JSON response.
• Verify the upgrade via the Grav Package Manager (GPM) or by replacing the plugin directory with the 1.2.11 release.
• After upgrading, confirm that unauthenticated requests to /admin/comments/page:<n> no longer return comment data.
• Note: No patch evidence is currently tracked from any authoritative source. Version 1.2.11 is referenced in the NVD description as the fixing release — validate availability against the vendor's official repository before relying on it.

3) Long-term hardening

• Adopt a defense-in-depth posture that does not rely solely on the classic Admin plugin's login screen for authorization of admin handlers.
• Enforce authentication at the handler or controller layer for any route returning sensitive data, not merely service registration checks.
• Audit all Grav plugin admin handlers for analogous isAdmin()-style mis-checks.
• Migrate to the Grav 2.0 Admin Next stack (admin2 + api), which is documented as not affected via this path.
• Implement WAF rules and logging to catch unauthorized admin-route enumeration across all plugins.
• Suppress absolute filesystem paths from all API responses by design.

References

• NVD — CVE-2026-100672: https://nvd.nist.gov/vuln/detail/CVE-2026-100672
• Grav CMS official site and plugin repository: https://getgrav.org
• getgrav/grav-plugin-comments repository: https://github.com/getgrav/grav-plugin-comments
• CWE-306 Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No threat actor campaigns or exploit-in-the-wild evidence have been attributed to CVE-2026-100672 at the time of writing. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public PoC, exploit code, or Nuclei template is currently available.