CVE-2026-72782

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.5 Craft CMS versions 4.0.0-RC1 through 4.18.1

Description Authenticated users with control panel access can leak arbitrary environment variables and secrets. This occurs because the software interpolates environment variables and secrets via ${ENV VAR} strings in the elementId parameter into Twig templates before rendering, bypassing the Twig sandbox. An attacker can use a blind error-based technique across multiple requests to incrementally extract sensitive data, such as the CRAFT SECURITY KEY, which can be used to forge sessions, escalate privileges, and steal credentials for databases, SMTP, APIs, or blob storage.

Recommendations Update to version 5.10.6 or later. Update to version 4.18.2 or later.