What is CVE-2025-66307?

CVE-2025-66307 is a medium-severity vulnerability in Getgrav Grav, classified under Observable Response Discrepancy. CVSS score: 6.5/10. Published 2025-12-01.

How severe is CVE-2025-66307?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Getgrav Grav

CVE-2025-66307

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering. This vulnerability is fixed in 1.11.0-beta.1.

EPSS: 0.003 (20.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L.

Affected products

Getgrav Grav — versions < 1.11.0-beta.1
Getgrav Grav-plugin-admin

Weakness classification (CWE)

CWE-204 — Observable Response Discrepancy

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-66307?: CVE-2025-66307 is a medium-severity vulnerability in Getgrav Grav, classified under Observable Response Discrepancy. CVSS score: 6.5/10. Published 2025-12-01.
How severe is CVE-2025-66307?: Medium severity. CVSS v3 base score is 6.5 out of 10.