Exposure Of Sensitive Information

Grav is vulnerable to Exposure of Sensitive Information The vulnerability is due to insufficient field filtering in the allow-listed offsetGet and offsetExists methods for User objects, which allows an attacker with page-edit permissions to access sensitive fields such as password hashes and 2FA...

GHSA-3JHR-MXMX-38CX Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Summary system/config/security.yaml's Twig sandbox policy allow-lists offsetget and offsetexists for Grav\Common\User\Interfaces\UserInterface. The concrete Grav\Common\User\DataUser\User class does not filter which fields offsetGet returns, so any sandboxed template with access to a User object...

Duplicate Advisory: Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3jhr-mxmx-38cx. This link is maintained to preserve external references. Original Description Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and...

CVE-2026-76839 Grav before 2.0.16 Information Disclosure via offsetGet

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

CVE-2026-76839: Insufficiently Protected Credentials

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

PT-2026-81148

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.16 Description Sandboxed Twig templates can access sensitive User fields because the allow-listed offsetGet and offsetexists methods lack proper field filtering. Users with page-edit permissions can utilize the...