[rhukster]

Part of the December 2025 batch the global entry files as core before 1.8.0-beta.27, but the only fix is in the Admin plugin: commit 99f65329 in grav-plugin-admin, first released in Admin 1.11.0-beta.1. Grav core has no commit for it, and Admin 1.10.61 (the current 1.7-line release) still has the unescaped template. Admin 1.11 needs Grav 1.8.0-beta.1 or later, so this is fixed only on the Grav 2 line. The fix is in grav-plugin-admin commit 99f65329, first released in Admin 1.11.0-beta.1; Grav core has no commit for it, and Admin 1.10.61 still has the unescaped template. Correct affected products: Composer package getgrav/grav-plugin-admin, affected < 1.11.0-beta.1, patched 1.11.0-beta.1.

Updated after review: Admin 1.11.0-beta.1 (commit 99f65329) removed only the email disclosure. taskForgot() still answers a rate-limited existing user differently from a nonexistent user in every Admin release (1.11.0-beta.1 through 1.11.0-beta.6, and 1.10.61), so the user enumeration this advisory describes is not fixed. The range is now open with no patched version, and the PACKAGE reference points to the Admin plugin repository. Correct affected products: Composer package getgrav/grav-plugin-admin, all versions affected, no patched version yet.

[Copilot]

🟡 Changes recommended

The advisory marks 1.11.0-beta.1 as fixed despite password-recovery responses still enabling user enumeration, which would prematurely suppress alerts.

1 open issue

• Keep user-enumeration advisory open until the issue is fully fixed · New

What changed in this PR

Updates GHSA-q3qx-cp62-f6m7 to identify Grav’s Admin plugin, rather than Grav core, as the affected Composer package.

Changes:

• Changes the package to getgrav/grav-plugin-admin.
• Sets the recorded fixed version to 1.11.0-beta.1 and refreshes the modification timestamp.

File	Description
advisories/​github-reviewed/​2025/​12/​GHSA-q3qx-cp62-f6m7/​GHSA-q3qx-cp62-f6m7.json	Updates the affected package, version boundary, and modification timestamp.

_{Review effort: Max (auto)}

[rhukster]

Agreed. At 1.11.0-beta.1 (831fb26), taskForgot() answers a nonexistent or disabled user with the success message FORGOT_INSTRUCTIONS_SENT_VIA_EMAIL, but once an existing user hits the pw_resets limit it returns the error FORGOT_CANNOT_RESET_RATE_LIMITED ("Password reset temporarily blocked due to too many attempts..."). That is the reporter's PoC without the email address, so usernames can still be enumerated. The same code is in the latest pre-release 1.11.0-beta.6 and at the head of the 1.11 branch (48bdd2b), and the 1.10 line (1.10.61, and develop at 15d2bdf) still uses PLUGIN_LOGIN.FORGOT_CANNOT_RESET_IT_IS_BLOCKED with the email in the message. So no Admin release fixes this advisory as written; commit 99f65329 only removed the email disclosure. I removed the fixed event, so the range is open (introduced: 0 only), and the repository advisory is now >= 0 with no patched version. When an Admin release gives the same response in the rate-limited branch, the range can get a fixed version. The PACKAGE reference now points to https://github.com/getgrav/grav-plugin-admin.

[rhukster]

Updated: Admin 1.10.62 (released today) fixes this on the 1.10 line, so the range is now < 1.10.62 with 1.10.62 as the patched version. The 1.11.0 betas (beta.1 to beta.6, the old Grav 1.8 beta line) are still affected and won't be fixed: that line became Grav 2, which uses Admin2 instead. The repository advisory (getgrav/grav GHSA-q3qx-cp62-f6m7) has the same two ranges.