CVE-2026-76839: Insufficiently Protected Credentials in getgrav grav

The vulnerability exists because Grav's Twig sandbox policy allow-lists offsetGet and offsetExists methods for the UserInterface, but the concrete User class does not filter sensitive fields in offsetGet, exposing hashed_password, secret (2FA seed), and twofa_secret directly to sandboxed templates. This bypasses the redaction applied in jsonSerialize, enabling any sandboxed template with access to a User object to read sensitive credential data. The issue was confirmed by live testing with Grav's real Twig sandbox environment and security policy configuration, demonstrating that offsetGet calls return sensitive data while direct property access is blocked.

An attacker able to inject or control sandboxed Twig templates can read sensitive user credential data including password hashes and two-factor authentication secrets. This exposure could lead to credential compromise and unauthorized account access. The vulnerability has a high CVSS score of 8.7 due to network attack vector, no required privileges or user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid allowing untrusted users to supply or control Twig templates with access to User objects. Review and restrict Twig sandbox policies to prevent allow-listing offsetGet and offsetExists methods on UserInterface or ensure these methods properly redact sensitive fields. Monitor vendor channels for an official fix.