CVE-2026-76839: Grav User interface credential leak via Twig sandbox offsetGet

CVE-2026-76839 · Severity: high · CVSS 7.7 · Published 2026-08-25

Grav is a flat-file CMS that allows editors to create templated content using Twig. The sandbox policy intended to restrict what data editors can access was misconfigured to allow direct access to User objects. An attacker with page-edit permissions can exploit this to extract password hashes and two-factor authentication secrets from any user object exposed in templates, enabling offline password cracking and 2FA bypass without the victim's device.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-76839 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76839 being exploited in the wild.
How severe is CVE-2026-76839?
High severity, with a CVSS score of 7.7, published 25 August 2026.
Which products and versions are affected?
Grav up to and including 2.0.15; getgrav/grav (Packagist) <= 2.0.15, ECOSYSTEM:introduced=0,fixed=2.0.16.
Is there a fix for CVE-2026-76839?
Yes. getgrav/grav (Packagist): upgrade to 2.0.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76839 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-76839?
Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getgrav/grav (Packagist): upgrade to 2.0.16 or later
    composer require getgrav/grav:^2.0.16

Technical details

The vulnerability is a sandbox bypass in Grav's Twig sandbox configuration. The `system/config/security.yaml` allow-lists the `offsetget` and `offsetexists` methods on `UserInterface` objects. While the `User` class filters sensitive fields (hashed_password, secret, twofa_secret) in its `jsonSerialize()` method for normal access, the `offsetGet()` method override performs no filtering and returns all fields directly. Additionally, the parent `Data` class is independently allow-listed with generic accessors (`get`, `value`, `offsetGet`) that also leak the same secrets. An authenticated user with page-edit permission can call `user.offsetGet('hashed_password')`, `user.offsetGet('secret')`, or `user.offsetGet('twofa_secret')` in sandboxed Twig templates to extract credentials. The Twig subscript form (`user['field']`) is correctly blocked by the sandbox, but the explicit method call form bypasses filtering. The attack requires the User object to be bound into the template context (a documented pattern in Grav) and page-edit permissions.

Affected products

  • Grav Grav up to and including 2.0.15

Identifiers

  • CVE-2026-76839
  • GHSA-3jhr-mxmx-38cx

Timeline

  • 2026-09-17: disclosed: Vulnerability disclosed via GHSA-3jhr-mxmx-38cx
  • 2026-01-01: other: CVE-2026-76839 assigned (future date indicates advisory timestamp context)

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.