The Grav Admin2 plugin (getgrav/grav-plugin-admin2) versions prior to 2.0.4 embed a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin and its subroutes. This variable is included in every unauthenticated response and exposes sensitive information such as the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers. This information disclosure enables unauthenticated attackers to fingerprint the deployment and select version-specific exploits without prior reconnaissance.

Exposure of sensitive configuration details to unauthenticated actors increases the risk of targeted attacks by revealing exact version numbers and deployment details. Although no direct code execution or data modification is described, the information leakage significantly aids attackers in crafting precise exploits against known vulnerabilities in the affected versions.

A fixed version 2.0.4 of the Grav Admin2 plugin addresses this issue by removing the sensitive configuration exposure. Users should upgrade to version 2.0.4 or later to remediate this vulnerability. Patch status is not explicitly confirmed in the vendor advisory, but the version boundary indicates that upgrading to 2.0.4 or above mitigates the issue. No other mitigations or temporary fixes are documented.