Executive brief
Grav is a flat-file content management system used to build websites. When an administrator enables the optional config_access feature to safely expose low-sensitivity settings like site title to page editors, a gap in the default security policy allows editors to access sensitive system configuration secrets (such as Redis database passwords) stored under the `system.*` configuration tree. Any user with page-editing permissions can extract these credentials through Twig template expressions.
Technical details
The vulnerability exists in the default `config_denied_paths` denylist in `system/config/security.yaml`, which is incomplete and omits the `system` prefix. The `SandboxConfig` facade (introduced in GHSA-j274-39qw-32c9) correctly filters configuration access based on the denylist, but the shipped defaults cover only `plugins`, `streams`, `security`, `backups`, and `scheduler`, leaving `system.*` exposed. When `twig_content.config_access` is enabled (an optional but documented setting), any user with page-edit permissions can call `config.get('system.cache.redis.password')` or `config.toArray()` in Twig templates to extract credentials. The attack requires admin configuration of the feature and page-edit access, but bypasses the intended secret redaction mechanism for system configuration values.
Affected products
- Grav Grav 2.0.15 and likely all versions with twig_sandbox config_access feature
Timeline
- 2026-09-17: disclosed
- other: CVE-2026-76846 assigned