CVE-2026-42610: Grav CMS information disclosure via accounts service bypass in Twig

Executive brief

A vulnerability in Grav CMS allows users with limited permissions, such as content editors, to access sensitive system information. By bypassing security restrictions in the template engine, an attacker can view administrative password hashes and the system's security salt. This information could be used to perform offline password cracking and gain full control over the website.

Technical details

An incorrect authorization vulnerability (CWE-863) in Grav CMS allows a low-privileged user with page update permissions to bypass Twig sandbox restrictions. By utilizing the 'grav['accounts']' service within a Twig template, an attacker can programmatically load administrative user objects and extract Bcrypt password hashes and the 'security.salt' value. This occurs because the Accounts Service was not properly restricted in the Twig environment. The issue is fixed in version 2.0.0-beta.2 by moving sensitive keys out of the accessible configuration tree and implementing a more restrictive sandbox allowlist.

Affected products

• getgrav Grav CMS < 2.0.0-beta.2

Timeline

• 2026-04-24: patched: Fix applied to Grav core 2.0 branch.
• 2026-05-05: disclosed: Advisory published on GitHub.

References

• https://api.github.com/users/Samer666569
• https://github.com/Samer666569
• https://api.github.com/users/Samer666569/gists%7B/gist_id%7D
• https://api.github.com/users/Samer666569/repos
• https://avatars.githubusercontent.com/u/58629434?v=4
• https://api.github.com/users/Samer666569/events%7B/privacy%7D