CVE-2026-76846 describes a security flaw in Grav before version 2.0.16. The issue arises from an incomplete default denylist in the Twig sandbox configuration, which fails to block access to sensitive system configuration secrets. Attackers who have page-edit permissions can exploit this by using config.get() or config.toArray() functions within Twig templates to retrieve confidential values such as system.cache.redis.password, provided that config_access is enabled. This vulnerability could lead to exposure of critical credentials stored in the system configuration.

The vulnerability allows unauthorized disclosure of sensitive credentials stored in the system configuration, such as Redis cache passwords. This could lead to further compromise of the system or connected services if attackers gain page-edit permissions and config_access is enabled. The CVSS 4.0 score of 8.7 indicates a high severity impact due to network attack vector, low complexity, and high confidentiality impact.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict page-edit permissions to trusted users only and consider disabling config_access if not required to reduce exposure risk.