Grav CMS versions before 2.0.16 contain a vulnerability in sandboxed Twig templates where allow-listed offsetGet() and offsetexists() methods on User objects do not filter sensitive fields. This allows attackers with page-edit permissions to access hashed passwords and two-factor authentication secrets. The vulnerability enables offline password cracking and potential authentication bypass.