Grav v1.7.49.5 / Admin v1.10.49.1 – User Enumeration & Email Disclosure

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.0-beta.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-66307"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-02T00:38:24Z",
    "nvd_published_at": "2025-12-01T22:15:50Z",
    "severity": "MODERATE"
  },
  "details": "# Grav v1.7.49.5 / Admin v1.10.49.1 \u2013 User Enumeration \u0026 Email Disclosure\n\n### Summary\nA **user enumeration and email disclosure vulnerability** exists in Grav **v1.7.49.5** with Admin plugin **v1.10.49.1**.  \nThe \"Forgot Password\" functionality at `/admin/forgot` leaks information about valid usernames and their associated email addresses through distinct server responses.  \nThis allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering.  \n\n### Details\n\nThe issue resides in the [`taskForgot()`](https://github.com/getgrav/grav-plugin-admin/blob/6d673fc7c4f6962756f93ae651371e81f7f20924/classes/plugin/Controllers/Login/LoginController.php#L349) function, which handles the forgot password workflow.  \nRelevant vulnerable logic:\n\n```php\nif (null === $user || $user-\u003estate !== \u0027enabled\u0027 || !$to) {\n    ...\n    // Generic message for invalid/non-existing users\n    $this-\u003esetMessage($this-\u003etranslate(\u0027PLUGIN_ADMIN.FORGOT_INSTRUCTIONS_SENT_VIA_EMAIL\u0027));\n    return $this-\u003ecreateRedirectResponse($current);\n}\n\nif ($rateLimiter-\u003eisRateLimited($username)) {\n    ...\n    $interval = $config-\u003eget(\u0027plugins.login.max_pw_resets_interval\u0027, 2);\n\n    // Sensitive message for valid users\n    $this-\u003esetMessage($this-\u003etranslate(\u0027PLUGIN_LOGIN.FORGOT_CANNOT_RESET_IT_IS_BLOCKED\u0027, $to, $interval), \u0027error\u0027);\n\n    return $this-\u003ecreateRedirectResponse($current);\n}\n```\n\nWhen an attacker submits the password reset form at `/admin/forgot` with an **invalid username**, the application responds with:  \n\n```\nInstructions to reset your password have been sent to your email address\n```\n\nHowever, when a **valid username** is supplied, and the attacker repeatedly triggers password reset requests, the application responds with:  \n\n```\nCannot reset password for \u003cUSER_EMAIL\u003e, password reset functionality temporarily blocked, please try later (maximum 60 minutes)\n```\n\nThis discrepancy in responses enables:  \n1. **User Enumeration** \u2013 Attackers can determine if a username exists in the system by analyzing the response.  \n2. **User Email Disclosure** \u2013 The system discloses the actual email address associated with the account (e.g., `admin@localhost.test`).  \n\nThis violates best practices for authentication flows, where responses should remain generic to avoid leaking sensitive information.\n\n### PoC\n1. Navigate to the **Forgot Password** page:  `https://\u003ctarget\u003e/admin/forgot`\n1. Submit a reset request with a random/invalid username (e.g., `invalid_user`):  \n\n- Response:  \n  ```\n  Instructions to reset your password have been sent to your email address\n  ```\n3. Submit a reset request with a valid username (e.g., `admin`).  \n4. Repeatedly request a reset for the same username until the lockout mechanism triggers.  \n- Response:  \n  ```\n  Cannot reset password for admin@localhost.test, password reset functionality temporarily blocked, please try later (maximum 60 minutes)\n  ```\n5. Observe the leaked **email address** of the admin account in the error message.  \n\n### Impact\n- **Severity:** Medium  \n- **Type:** Information Disclosure / User Enumeration  \n- **Who is Impacted:** All Grav sites using Admin plugin **v1.10.49.1** with password reset enabled.  \n- **Risks:**  \n  - Allows attackers to enumerate valid usernames.  \n  - Exposes email addresses of admin accounts, which can be used in:  \n  - Credential stuffing  \n  - Password spraying  \n  - Phishing/social engineering campaigns  \n  - Further exploitation in combination with other vulnerabilities  \n\n\n### Recommendation\n\n- Modify the [`taskForgot()`](https://github.com/getgrav/grav-plugin-admin/blob/6d673fc7c4f6962756f93ae651371e81f7f20924/classes/plugin/Controllers/Login/LoginController.php#L349) logic to always return a generic, non-identifying message, regardless of whether the username exists or rate limits are hit.\n\n- Example safe response:\n  ```ini\n  If the account exists, password reset instructions will be sent.\n  ```\n\n- Do not include email addresses ($to) or other sensitive data in error messages.",
  "id": "GHSA-q3qx-cp62-f6m7",
  "modified": "2025-12-02T00:38:24Z",
  "published": "2025-12-02T00:38:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-q3qx-cp62-f6m7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66307"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav-plugin-admin/blob/6d673fc7c4f6962756f93ae651371e81f7f20924/classes/plugin/Controllers/Login/LoginController.php#L349"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grav Admin Plugin vulnerable to User Enumeration \u0026 Email Disclosure"
}