Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin (and its subroutes). This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers, allowing an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without reconnaissance.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-11 | 2 | Disclosure2 |
| 2026-07-12 | 1 | Patch1 |
CVE-2026-61454 The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/… https://www.cve.org/CVERecord?id=CVE-2026-61454
Post summary
The CVE reveals that the Grav Admin2 plugin (pre‑2.0.4) exposes its configuration through a global JavaScript variable within the admin bootstrap page.
CVE-2026-61454 (CVSS 8.7): Grav Admin2 plugin before 2.0.4 exposes config data. Update immediately if using Grav CMS. https://nvd.nist.gov/vuln/detail/CVE-2026-61454 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/AhGIlPoo2W
Post summary
The post alerts users to a CVE that exposes configuration data in Grav Admin2 and recommends an update, but provides no PoC, exploit, or active usage evidence.
🚨*CVE* CVE-2026-61454 The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/… https://www.cve.org/CVERecord?id=CVE-2026-61454 ----- Traducción: CVE-2026-61454 El … http://infoflow.cloud`
Post summary
The text discloses a configuration exposure in Grav Admin2 plugin, describing the vulnerability details but providing no PoC, exploit code, active exploitation evidence, patch, or debunking.