CVE-2026-47732 describes an incorrect authorization vulnerability (CWE-863) in twigphp Twig versions before 3.26.0. The vulnerability arises because multiple Twig language constructs trigger PHP string coercion on Stringable objects without consulting the SecurityPolicy::checkMethodAllowed() method. This allows sandboxed template authors to invoke the __toString() method on objects accessible in the render context through various expressions and tags, including conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the range operator. This bypass of authorization checks could lead to unintended method invocation. The vulnerability is resolved in Twig version 3.26.0.

An attacker with the ability to author sandboxed templates can invoke the __toString() method on objects reachable in the rendering context without proper authorization. This could lead to unauthorized code execution paths or information disclosure depending on the __toString() implementations. The CVSS 4.0 score is 7.1 (high), indicating a significant risk if exploited. There are no known exploits in the wild at this time.

Upgrade Twig to version 3.26.0 or later, where this authorization bypass vulnerability is fixed. No other official remediation or temporary fixes are documented. Patch status is not explicitly stated but the fix is included in version 3.26.0, so upgrading to this version or newer is the recommended mitigation.