CVE-2026-76839: Grav CMS Authentication Bypass Vulnerability

CVE-2026-76839 Overview

CVE-2026-76839 is an information disclosure vulnerability in Grav CMS before version 2.0.16. The flaw allows sandboxed Twig templates to reach sensitive User object fields through allow-listed offsetGet() and offsetExists() methods. These methods do not filter which fields callers can access. An attacker with page-edit permissions can invoke offsetGet() on User objects to retrieve hashed passwords and two-factor authentication (2FA) secrets. The extracted material supports offline password cracking and authentication bypass. The issue is classified under [CWE-522: Insufficiently Protected Credentials].

Critical Impact

Authenticated editors can extract password hashes and 2FA secrets from Grav user accounts, enabling account takeover of higher-privileged users including administrators.

Affected Products

• Grav CMS versions prior to 2.0.16
• Twig template rendering component of Grav
• Grav User object accessor methods (offsetGet(), offsetExists())

Discovery Timeline

• 2026-08-25 - CVE-2026-76839 published to NVD
• 2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-76839

Vulnerability Analysis

Grav renders content through Twig templates running inside a sandbox that restricts which PHP methods templates can invoke. The sandbox maintains an allow-list of safe methods that templates may call on exposed objects. The offsetGet() and offsetExists() methods on the User object are included in this allow-list because they support legitimate profile rendering.

The allow-list check operates at the method level, not at the field level. Any caller that reaches an allowed method can request any field the underlying object exposes. The User object stores authentication secrets alongside display fields, so offsetGet('hashed_password') and offsetGet('twofa_secret') return credential material to the template. This turns a template rendering surface into a credential extraction primitive.

Root Cause

The root cause is missing field-level authorization on the offsetGet() and offsetExists() accessors of the User class. The Twig sandbox trusts the accessor because it is allow-listed, and the accessor trusts the caller because it was invoked through a sanctioned method. Neither layer enforces which properties are safe to disclose, so sensitive fields inherit the same access rules as public profile fields.

Attack Vector

An attacker needs an account with page-edit permissions in a target Grav site. The attacker creates or modifies a page containing Twig markup that iterates over User objects or targets specific usernames. The template calls offsetGet() for fields such as the password hash and 2FA seed, then renders the values into the page output. Rendering the page returns the credentials to the attacker. Offline cracking of the recovered hash and reconstruction of TOTP codes from the 2FA secret allow full authentication bypass against higher-privileged accounts.

See the GitHub Security Advisory GHSA-3jhr-mxmx-38cx and the VulnCheck Advisory on Grav Information Disclosure for technical details.

Detection Methods for CVE-2026-76839

Indicators of Compromise

• Page content or saved Twig templates that reference offsetGet or offsetExists against User, users, or grav.user objects.
• Rendered pages containing bcrypt-style hash prefixes such as $2y$ or Base32 strings resembling TOTP seeds.
• Recent page edits by non-administrative accounts that touch templates outside their normal content scope.
• Successful administrator logins from new IP addresses following editor activity on Twig-enabled pages.

Detection Strategies

• Review Grav page revision history for Twig expressions that access User fields by key name.
• Inspect web server access logs for anomalous page renders returning large response bodies to editor sessions.
• Alert on authentication events where an administrator logs in shortly after an editor account edits content.

Monitoring Recommendations

• Enable Grav audit logging for user edits and page saves, and forward events to a central log store for retention.
• Monitor filesystem changes under user/pages/ for new .md or .twig files containing offsetGet references.
• Track failed and successful logins for privileged accounts and correlate against editor activity windows.

How to Mitigate CVE-2026-76839

Immediate Actions Required

• Upgrade Grav to version 2.0.16 or later on all instances.
• Rotate passwords for every Grav account, prioritizing administrators and any user whose profile was rendered through Twig.
• Regenerate 2FA secrets for all users who had 2FA enabled prior to patching.
• Audit page-edit role assignments and remove editor permissions from accounts that do not require them.

Patch Information

The fix is available in Grav 2.0.16. The patch restricts which User fields are reachable through the allow-listed offsetGet() and offsetExists() methods so credential fields are no longer returned to Twig callers. Refer to the GitHub Security Advisory GHSA-3jhr-mxmx-38cx for release notes and commit references.

Workarounds

• If patching is not immediately possible, revoke page-edit permissions from all non-administrator accounts until the upgrade is applied.
• Disable Twig processing in page content by clearing the process.twig flag in system.yaml for sites that do not require it.
• Place the Grav administration and edit surfaces behind an IP allow-list or VPN to reduce the attacker population.
• Review existing page content for Twig expressions referencing User objects and remove them before upgrading.