CVE-2026-76839: Grav before 2.0.16 Information Disclosure via offsetGet
Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering. Attackers with page-edit permissions can call offsetGet() on User objects to extract hashed passwords and 2FA secrets, enabling offline password cracking and authentication bypass.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gravto a version that resolves this vulnerability.Fixed in 2.0.16 - Configuration
Ensure sandboxed Twig templates cannot access sensitive User fields through allow-listed offsetGet() and offsetexists() (field filtering is missing in versions before 2.0.16).
Grav Twig templating sandbox allow-listed offsetGet()/offsetexists() access to User fields = disable or remove allow-list access to sensitive User fields via offsetGet() and offsetexists()
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
An attacker needs page-edit permissions and the ability to use sandboxed Twig templates. The issue is therefore most relevant where untrusted or insufficiently trusted users can edit pages or template content.
What data could be exposed, and why does it matter?
Affected templates can retrieve sensitive User object fields, including hashed passwords and 2FA secrets. Exposed password hashes may be cracked offline, while 2FA secrets could enable authentication bypass.
What should be prioritized for remediation?
Upgrade Grav to 2.0.16 or later. Until upgrading is possible, restrict page-edit permissions and prevent untrusted users from creating or modifying sandboxed Twig templates.
How can I determine whether an instance is affected?
Instances running Grav before 2.0.16 are affected. Review whether users with page-edit permissions can invoke allow-listed offsetGet() or offsetexists() methods from sandboxed Twig templates against User objects.