Duplicate Advisory: Craft CMS: Authenticated leak of secret environment variables

Craft CMS versions >=4.0.0-RC1 before 4.18.2 and >=5.0.0-RC1 before 5.10.6 interpolate environment variables and secrets via ${ENV_VAR} strings in the elementId parameter into Twig templates prior to rendering, even with the Twig sandbox enabled. An authenticated attacker with control panel access can render malicious sandboxed Twig templates and use a blind error-based technique over multiple requests to leak arbitrary environment variables and secrets. These leaked secrets can be abused to forge sessions (using CRAFT_SECURITY_KEY), escalate privileges, and steal credentials for database, SMTP, API, or blob storage. The vulnerability is addressed in versions 4.18.2 and 5.10.6.

An authenticated attacker with control panel access can incrementally leak sensitive environment variables and secrets, potentially allowing session forgery, privilege escalation, and theft of critical credentials such as database, SMTP, API, or blob storage keys. This compromises confidentiality but does not affect integrity or availability directly.

This vulnerability is fixed in Craft CMS versions 4.18.2 and 5.10.6. Users should upgrade to these versions or later to remediate the issue. No other mitigations are indicated by the vendor advisory.