CVE-2026-76846

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/getgrav/grav/security/advisories/GHSA-xjw5-q542-3vmr
https://www.vulncheck.com/advisories/grav-before-information-disclosure-via-twig-sandbox
https://github.com/getgrav/grav/security/advisories/GHSA-xjw5-q542-3vmr

Configurations

No configuration.

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Grav antes de la versión 2.0.16 contiene una lista de denegación predeterminada incompleta en la configuración del sybox de Twig que no logra bloquear el acceso a secretos de configuración del sistema. Atacantes con permiso de edición de página pueden usar config.get() o config.toArray() en plantillas Twig para recuperar valores sensibles como system.cache.redis.password cuyo config_access está habilitado.

Information

Published : 2026-08-25 02:16

Updated : 2026-10-12 15:10

NVD link : CVE-2026-76846

Mitre link : CVE-2026-76846

CVE.ORG link : CVE-2026-76846

JSON object : View

Products Affected

No product.

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-76846", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76846", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-27T14:55:11.428296Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.16", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.16", "versionType": "semver"}], "packageURL": "pkg:composer/getgrav/grav", "defaultStatus": "unaffected"}]}], "published": "2026-08-25T02:16:51.743", "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-xjw5-q542-3vmr", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/grav-before-information-disclosure-via-twig-sandbox", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-xjw5-q542-3vmr", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled."}, {"lang": "es", "value": "Grav antes de la versi\u00f3n 2.0.16 contiene una lista de denegaci\u00f3n predeterminada incompleta en la configuraci\u00f3n del sybox de Twig que no logra bloquear el acceso a secretos de configuraci\u00f3n del sistema. Atacantes con permiso de edici\u00f3n de p\u00e1gina pueden usar config.get() o config.toArray() en plantillas Twig para recuperar valores sensibles como system.cache.redis.password cuyo config_access est\u00e1 habilitado."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "disclosure@vulncheck.com"}