The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS up to version 1.2.10 registers an admin handler that returns comment data as JSON without proper authentication. The handler's access control relies on isAdmin(), which only checks if the admin service is registered on the route, not if the user is authenticated. Consequently, unauthenticated attackers can access the endpoint /admin/comments/page:<n> to retrieve all comments from the last 7 days, including email addresses and absolute server filesystem paths of comment data files. This occurs before the classic Admin plugin renders its login screen, allowing data exposure. The vulnerability is resolved in version 1.2.11 by enforcing authentication with admin.comments or admin.super permissions and removing the absolute file path from the response. Grav 2.0 Admin Next stack (admin2 + api) is not vulnerable via this path.

Unauthenticated remote attackers can access sensitive comment data, including commenters' email addresses and absolute server file paths, potentially leading to privacy violations and information disclosure about the server's filesystem structure. This exposure could facilitate further targeted attacks or reconnaissance. The vulnerability affects sites using the classic Admin plugin with Comments enabled and Grav CMS versions before 1.2.11. Sites using Grav 2.0 Admin Next stack are not impacted by this issue.

Upgrade the Comments plugin to version 1.2.11 or later, which requires authenticated users with admin.comments or admin.super permissions to access comment data and removes absolute file path information from responses. This patch effectively mitigates the vulnerability. No additional action is required for sites running the Grav 2.0 Admin Next stack, as they are not affected by this issue.