Advisory · CVE-2026-100672
Grav Comments plugin leaks emails and server paths with no login
The Comments plugin for Grav CMS through 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check: it branches on isAdmin(), which only indicates the admin service is registered on the route rather than that the visitor is authenticated, and it echoes the JSON before the classic Admin plugin would render its login screen. On a site using the classic Admin plugin with Comments enabled, an unauthenticated remote attacker can request the comments admin route and retrieve every comment from the last 7 days, including commenter email addresses and the absolute server filesystem path of the data file. Fixed in 1.2.11, which requires an authenticated user with admin.comments or admin.super and removes the absolute filePath.
- Vendor
- Grav
- Product
- Grav Comments plugin
- Identifier / CWE
- CVE-2026-100672
CWE-306 - Action timing
- Immediate
Explain it like I’m five
The comments office door checks whether it is an office door, not whether you work there. A stranger walks in and copies the guest book, emails and filing-cabinet labels included.
- 01Admin route requested
An unauthenticated attacker requests the Comments admin route.
- 02isAdmin() misread
The handler branches on isAdmin(), which only means the admin service is registered on the route, not that the visitor is authenticated.
- 03JSON echoed early
The comment data is echoed as JSON before the classic Admin plugin would render its login screen.
- 04Data disclosed
Every comment from the last 7 days is returned, including commenter emails and the absolute server filesystem path.
What happened
The Comments plugin for Grav CMS through 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check (CVE-2026-100672, CVSS 8.7). The handler branches on isAdmin(), which only indicates the admin service is registered on the route rather than that the visitor is authenticated, and it echoes the JSON before the classic Admin plugin would render its login screen. On a site using the classic Admin plugin with Comments enabled, an unauthenticated remote attacker can request the comments admin route and retrieve every comment from the last 7 days, including commenter email addresses and the absolute server filesystem path of the data file. Fixed in Comments 1.2.11, which requires an authenticated user with admin.comments or admin.super and removes the absolute filePath from the response.
What to do
- Upgrade the Comments plugin to 1.2.11 or later.
- Audit access logs for unauthenticated requests to the comments admin route.
- Treat exposed commenter email addresses as disclosed and notify affected users if your policy requires it.
- Note the exposed absolute filesystem path in your threat model; it aids further targeting.
Management note
“Is this the admin area?” is not authentication. This is a plugin bug, not a core bug, which makes it easy to miss in upgrade planning: plugin versions need the same patch discipline as the CMS itself.