CVE-2026-44738 is a high-severity vulnerability in the Grav file-based web platform affecting versions before 2.0.0-rc.2. The vulnerability arises from the Twig sandbox allow-list permitting users with the admin.pages role to invoke config.toArray() in page content, which dumps the entire merged site configuration. This includes sensitive plugin secrets like SMTP passwords, AWS keys, OAuth client secrets, and API tokens. Notably, exploitation does not require full administrator privileges. The vulnerability has a CVSS 3.1 score of 7.7, reflecting network attack vector, low attack complexity, and high confidentiality impact. The vendor has released a fix in version 2.0.0-rc.2. As this is a cloud service, the vendor typically manages remediation server-side.

An attacker with the admin.pages role can expose highly sensitive configuration data, including credentials and API keys, without needing full administrator privileges. This exposure can lead to unauthorized access to external services and compromise of the affected environment's confidentiality. There is no impact on integrity or availability reported. No known exploits are currently observed in the wild.

A patch is available in Grav version 2.0.0-rc.2 that fixes this vulnerability. Since Grav is a cloud-hosted service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory to confirm that their instance has been updated or patched accordingly. Until patched, restrict the admin.pages role to trusted users only to minimize exposure risk.