CVE-2025-66306

MediumCVSS 6.5/10Last modified Sep 26, 2026

Description

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS Admin Panel which allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin email addresses and other metadata can be exposed, increasing the risk of phishing, credential stuffing, and social engineering. This vulnerability is fixed in 1.8.0-beta.27.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Dec 1, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-663075.3This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663085.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663096.1This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-66317.8A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious a CVE-2025-663105.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663115.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663125.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663137.2ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handl CVE-2025-663147.5Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by AC CVE-2025-663158.8There is a configuration defect vulnerability in the version server of ZTE MF258K Pro products. Due to improper directory permission setting CVE-2025-663195.5Permission control vulnerability in the resource scheduling module. Impact: Successful exploitation of this vulnerability may affect service CVE-2025-66327.8A maliciously crafted PSD file, when linked or imported into Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious ac