vulnerability

CVE-2026-76839

NVD MEDIUM 6.5 · published 2026-08-25 · 1 on the wire

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering. Attackers with page-edit permissions can call offsetGet() on User objects to extract hashed passwords and 2FA secrets, enabling offline password cracking and authentication bypass.

Exploited in the wild

Not on KEV

Not in CISA's Known Exploited Vulnerabilities catalogue as of the last daily pull. Absence is not proof of safety.

EPSS · 30-day forecast

Chance of exploitation in the next 30 days, 20th percentile of all CVEs. A forecast; KEV outranks it.

CVSS · NVD

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Internet exposure

—

No exposure census on this CVE's dispatches.

On the wire1

18 SepGHSA-3jhr-mxmx-38cx: Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hasheVULN

References

Early access

Watch this one?

Early access opens alerts first — one email when a CVE you follow lands on KEV or an adversary you follow lands on the wire. Nothing else, ever.

bot-protected