CVE-2026-76846: Grav CMS Information Disclosure Vulnerability

CVE-2026-76846 is an information disclosure vulnerability in Grav CMS affecting versions before 2.0.16. Attackers with page-edit permissions can extract sensitive configuration secrets through Twig templates. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-76846 Overview

CVE-2026-76846 is an information disclosure vulnerability in Grav content management system (CMS) versions before 2.0.16. The flaw resides in the Twig sandbox configuration, which uses an incomplete default denylist that fails to block access to system configuration secrets. Authenticated users with page-edit permission can invoke config.get() or config.toArray() inside Twig templates to retrieve sensitive configuration values. When config_access is enabled, attackers can read secrets such as system.cache.redis.password. The vulnerability is classified under [CWE-522: Insufficiently Protected Credentials].

Critical Impact
Authenticated attackers with page-edit rights can extract stored credentials and configuration secrets from Grav sites, enabling lateral movement into backend services like Redis.

Affected Products

Grav CMS versions prior to 2.0.16
Grav installations with config_access enabled in Twig configuration
Grav deployments granting page-edit permissions to non-administrative users

Discovery Timeline

2026-08-25 - CVE-2026-76846 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-76846

Vulnerability Analysis

Grav uses the Twig templating engine and applies a sandbox to restrict what template authors can invoke. The sandbox relies on a denylist to block dangerous functions, methods, and properties. In versions before 2.0.16, this denylist is incomplete. It does not block the config object's get() and toArray() accessors when config_access is enabled.

An attacker with page-edit permission can craft a Twig template that reads arbitrary keys from the site's configuration tree. This exposes credentials, API keys, and infrastructure secrets stored in Grav's configuration files. The exposed data can include the Redis cache password, mail server credentials, and third-party service tokens.

The attack requires no user interaction and can be performed remotely over the network once authenticated access is obtained.

Root Cause

The root cause is a denylist-based security model that fails to enumerate every sensitive accessor on the config object. Denylist approaches are inherently fragile because new accessors and methods added over time can bypass existing restrictions. The Twig sandbox in Grav did not treat configuration secrets as an isolated trust boundary, allowing template-level code to reach into system settings.

Attack Vector

An attacker authenticates to Grav with a role that grants page or template editing rights. The attacker then injects Twig expressions such as {{ config.get('system.cache.redis.password') }} or {{ config.toArray() }} into a page or template. When the page is rendered, Grav evaluates the expression and returns the secret value in the response.

See the GitHub Security Advisory GHSA-xjw5-q542-3vmr and the VulnCheck advisory for further technical detail.

Detection Methods for CVE-2026-76846

Indicators of Compromise

Twig templates or page content containing references to config.get(, config.toArray(, or system.cache.redis.password
Unexpected edits to page frontmatter or template files by non-administrative accounts
Outbound authentication attempts to Redis, SMTP, or third-party APIs using credentials that match Grav configuration values

Detection Strategies

Audit Grav content directories and version control history for Twig expressions that reference the config object
Review Grav admin logs for page-edit activity performed by accounts that should not have template access
Correlate rendered page output with configured secrets to identify pages that echo sensitive values

Monitoring Recommendations

Alert on any Grav page save event that introduces config.get, config.toArray, or similar Twig accessors
Monitor Redis, mail, and API service logs for authentication attempts from unexpected source addresses
Track privileged role assignments in Grav to detect unauthorized grants of the page-edit permission

How to Mitigate CVE-2026-76846

Immediate Actions Required

Upgrade Grav to version 2.0.16 or later on all instances
Rotate every credential and secret stored in Grav configuration, including system.cache.redis.password
Review all user accounts with page-edit permission and remove access that is not strictly required
Inspect existing pages and templates for Twig expressions that invoke the config object

Patch Information

Grav 2.0.16 addresses the vulnerability by extending the Twig sandbox denylist to block config.get() and config.toArray() access to protected configuration paths. Refer to the GitHub Security Advisory GHSA-xjw5-q542-3vmr for the official fix and release notes.

Workarounds

Disable the config_access option in the Twig configuration until the upgrade is applied
Restrict page-edit permissions to fully trusted administrators only
Store sensitive credentials outside Grav configuration by using environment variables or an external secrets manager

bash

# Disable config_access in user/config/system.yaml
twig:
  config_access: false

# Verify installed Grav version
php bin/grav --version