CVE-2026-76839

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.16

Description Sandboxed Twig templates can access sensitive User fields because the allow-listed offsetGet() and offsetexists() methods lack proper field filtering. Users with page-edit permissions can utilize the offsetGet() function on User objects to retrieve hashed passwords and 2FA secrets, which may facilitate offline password cracking and authentication bypass.

Recommendations Update Grav to version 2.0.16 or later.