CVE-2026-77133 Broken Access Control in extension "femanager" (femanager)

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

EUVD-2026-65336

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite...

CVE-2026-77142 Broken Access Control in extension "Industry Directory" (yellowpages2)

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...

Insufficiently Protected Credentials

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the Twig sandbox configuration, which contains an incomplete default denylist. An attacker can access...

GHSA-CRRC-VPP2-F5X7 Duplicate Advisory: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xjw5-q542-3vmr. This link is maintained to preserve external references. Original Description Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block acce...

Duplicate Advisory: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xjw5-q542-3vmr. This link is maintained to preserve external references. Original Description Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block acce...

CVE-2026-76846

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

CVE-2026-76846 Grav before 2.0.16 Information Disclosure via Twig Sandbox

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

CVE-2026-76846

Grav before 2.0.16 contains an incomplete default denylist in its Twig sandbox configuration. Attackers with page-edit permission can leverage config.get() or config.toArray() within Twig templates to exfiltrate sensitive system configuration secrets (e.g., system.cache.redis.password) when confi...

EUVD-2026-65205

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

PT-2026-81149

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.16 Description An incomplete default denylist in the Twig sandbox configuration allows users with page-edit permissions to access system configuration secrets. When config access is enabled, an attacker can use the...

PT-2026-81233

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

CVE-2026-18985: Incorrect Authorization

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1...

CVE-2026-77133: Missing Authorization

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

CVE-2026-56707: Missing Authorization

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the backendconfig property deserialization in the profile edit API endpoint. An attacker can inject arbitrary configuration values that are written verbatim into the generated Liquidsoap script, enabling...

CVE-2026-76836

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backendconfig property in backend/src/Entity/Station.php is annotated with GROUPGENERAL, and PUT /api/station/stationid/profile/edit in...

CVE-2026-76836 AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backendconfig property in backend/src/Entity/Station.php is annotated with GROUPGENERAL, and PUT /api/station/stationid/profile/edit in...

CVE-2026-76836

AzuraCast (through 0.23.8 ) allows a station manager holding only the Profile permission to write Liquidsoap custom configuration fields via PUT /api/station/{station_id}/profile/edit. The root cause is that the backend_config property is serialized under GROUP_GENERAL without field-level permiss...

CVE-2026-76836 AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backendconfig property in backend/src/Entity/Station.php is annotated with GROUPGENERAL, and PUT /api/station/stationid/profile/edit in...