CVE-2026-117604

The Grav CMS (versions 1.7.53.3 before 1.7.53.6 ) is vulnerable to an authorization bypass in the Debugger::isDebuggerRequestAuthorized() function. This flaw allows unauthenticated visitors to access /__clockwork/ profiler data by exploiting a loopback REMOTE_ADDR fallback . When deployed behind ...