CVE-2026-76846

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.16

Description An incomplete default denylist in the Twig sandbox configuration allows users with page-edit permissions to access system configuration secrets. When config access is enabled, an attacker can use the config.get() or config.toArray() functions within Twig templates to retrieve sensitive information, such as the system.cache.redis.password variable.

Recommendations Update Grav to version 2.0.16 or later.