Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-76846: Grav before 2.0.16 lets editors read secret passwords
CVE-2026-76846 · published 2 months ago
Summary
In Grav versions earlier than 2.0.16, users who can edit pages can insert special template code to pull hidden configuration values, such as the Redis cache password. This exposure can lead to unauthorized access to backend services. Upgrade Grav to version 2.0.16 or later, and ensure that config_access is disabled for non‑admin users.
What to do
- Update getgrav grav to version 2.0.16.
- Update getgrav getgrav/grav to version 2.0.16.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | getgrav | grav | < 2.0.16 |
| composer | getgrav | grav |
<= 2.0.15 Fix: upgrade to 2.0.16
|
| Packagist | getgrav | getgrav/grav |
< 2.0.16 Fix: upgrade to 2.0.16
|
Original advisory text
Grav before 2.0.16 Information Disclosure via Twig Sandbox
Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76846... Vendor Advisory
- https://github.com/getgrav/grav/security/advisories/GHSA-xjw5-q542-3vmr Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-76846 Vendor Advisory
- https://github.com/advisories/GHSA-xjw5-q542-3vmr
- https://github.com/getgrav/grav Product
- https://www.vulncheck.com/advisories/grav-before-information-disclosure-via-twig... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-522Insufficiently Protected Credentials
Timeline
Published25 Aug 2026
Updated4 Nov 2026
First seen25 Aug 2026
Sources
GHSA-xjw5-q542-3vmr · GHSA
CVE-2026-76846 · NVD
CVE-2026-76846 · MITRE
CVE-2026-76846 · OSV
GHSA-xjw5-q542-3vmr · OSV
Track software like this
Free during beta