Grav CMS User Field Exposure via Twig Sandbox Bypass

Executive Summary

CVE-2026-76839 is an information disclosure vulnerability in Grav CMS versions before 2.0.16. It allows sandboxed Twig templates to access sensitive User fields like hashed passwords and 2FA secrets through allow-listed methods offsetGet() and offsetexists(). Attackers with page-edit permissions can exploit this to extract credentials and bypass authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Grav CMS version is below 2.0.16. Use commands like 'bin/grav version' in the Grav root directory to verify the installed version. Inspect Twig templates for unauthorized use of offsetGet() or offsetExists() methods on User objects.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with page-edit permissions to extract hashed passwords and 2FA secrets from User objects. This could lead to offline password cracking attempts and full authentication bypass if the hashed passwords are cracked or 2FA secrets are exposed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to exposure of sensitive user data such as hashed passwords and 2FA secrets, which may violate compliance requirements under GDPR (data protection) and HIPAA (protected health information). Unauthorized access to such data risks breaches of confidentiality and integrity standards required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Grav CMS to version 2.0.16 or later. Review and restrict page-edit permissions to trusted users only. Audit Twig templates for suspicious use of offsetGet() or offsetExists() methods on User objects and remove unauthorized access patterns.

Useful 0 Not Useful 0