Executive brief
Grav is a flat-file CMS that allows editors to create templated content using Twig. The sandbox policy intended to restrict what data editors can access was misconfigured to allow direct access to User objects. An attacker with page-edit permissions can exploit this to extract password hashes and two-factor authentication secrets from any user object exposed in templates, enabling offline password cracking and 2FA bypass without the victim's device.
Technical details
The vulnerability is a sandbox bypass in Grav's Twig sandbox configuration. The `system/config/security.yaml` allow-lists the `offsetget` and `offsetexists` methods on `UserInterface` objects. While the `User` class filters sensitive fields (hashed_password, secret, twofa_secret) in its `jsonSerialize()` method for normal access, the `offsetGet()` method override performs no filtering and returns all fields directly. Additionally, the parent `Data` class is independently allow-listed with generic accessors (`get`, `value`, `offsetGet`) that also leak the same secrets. An authenticated user with page-edit permission can call `user.offsetGet('hashed_password')`, `user.offsetGet('secret')`, or `user.offsetGet('twofa_secret')` in sandboxed Twig templates to extract credentials. The Twig subscript form (`user['field']`) is correctly blocked by the sandbox, but the explicit method call form bypasses filtering. The attack requires the User object to be bound into the template context (a documented pattern in Grav) and page-edit permissions.
Affected products
- Grav Grav up to and including 2.0.15
Timeline
- 2026-09-17: disclosed: Vulnerability disclosed via GHSA-3jhr-mxmx-38cx
- 2026-01-01: other: CVE-2026-76839 assigned (future date indicates advisory timestamp context)