Is CVE-2026-76846 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76846 being exploited in the wild.

How severe is CVE-2026-76846?

High severity, with a CVSS score of 7.5, published 25 August 2026.

Which products and versions are affected?

Grav 2.0.15 and likely all versions with twig_sandbox config_access feature; getgrav/grav (Packagist) <= 2.0.15, ECOSYSTEM:introduced=0,fixed=2.0.16.

Is there a fix for CVE-2026-76846?

Yes. getgrav/grav (Packagist): upgrade to 2.0.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76846 attacked?

It is attacked over the network.

Am I affected by CVE-2026-76846?

Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76846: Grav sandbox config denial paths incomplete, exposing system secrets

Q: Is there a fix for CVE-2026-76846?

Yes. getgrav/grav (Packagist): upgrade to 2.0.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-76846 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-76846?

Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76846 · Severity: high · CVSS 7.5 · Published 2026-08-25

Grav is a flat-file content management system used to build websites. When an administrator enables the optional config_access feature to safely expose low-sensitivity settings like site title to page editors, a gap in the default security policy allows editors to access sensitive system configuration secrets (such as Redis database passwords) stored under the `system.*` configuration tree. Any user with page-editing permissions can extract these credentials through Twig template expressions.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-76846 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76846 being exploited in the wild.
How severe is CVE-2026-76846?: High severity, with a CVSS score of 7.5, published 25 August 2026.
Which products and versions are affected?: Grav 2.0.15 and likely all versions with twig_sandbox config_access feature; getgrav/grav (Packagist) <= 2.0.15, ECOSYSTEM:introduced=0,fixed=2.0.16.
Is there a fix for CVE-2026-76846?: Yes. getgrav/grav (Packagist): upgrade to 2.0.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76846 attacked?: It is attacked over the network.
Am I affected by CVE-2026-76846?: Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

getgrav/grav (Packagist): upgrade to 2.0.16 or later
```
composer require getgrav/grav:^2.0.16
```

Technical details

The vulnerability exists in the default `config_denied_paths` denylist in `system/config/security.yaml`, which is incomplete and omits the `system` prefix. The `SandboxConfig` facade (introduced in GHSA-j274-39qw-32c9) correctly filters configuration access based on the denylist, but the shipped defaults cover only `plugins`, `streams`, `security`, `backups`, and `scheduler`, leaving `system.*` exposed. When `twig_content.config_access` is enabled (an optional but documented setting), any user with page-edit permissions can call `config.get('system.cache.redis.password')` or `config.toArray()` in Twig templates to extract credentials. The attack requires admin configuration of the feature and page-edit access, but bypasses the intended secret redaction mechanism for system configuration values.

Affected products

Grav Grav 2.0.15 and likely all versions with twig_sandbox config_access feature

Identifiers

CVE-2026-76846
GHSA-xjw5-q542-3vmr

Timeline

2026-09-17: disclosed
other: CVE-2026-76846 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.