The Grav Admin2 plugin (getgrav/grav-plugin-admin2) versions before 2.0.4 embed a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin and its subroutes. This variable is included in every unauthenticated response, disclosing sensitive information such as the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers. This information disclosure enables unauthenticated attackers to fingerprint the deployment and potentially select version-specific exploits without prior reconnaissance.

An unauthenticated attacker can obtain sensitive configuration details that reveal the server URL, API prefix, admin base path, runtime environment, and exact software versions. This information disclosure facilitates targeted attacks by enabling attackers to identify specific versions and configurations to exploit. However, no direct exploitation or privilege escalation is described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 2.0.4, upgrading to version 2.0.4 or later is likely the intended remediation once available. Until then, restrict access to the admin interface and monitor for suspicious activity related to information disclosure.