Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering. Attackers with page-edit permissions can call offsetGet() on User objects to extract hashed passwords and 2FA secrets, enabling offline password cracking and authentication bypass.

Affected: Packagist: getgrav/grav

## Summary

`system/config/security.yaml`'s Twig sandbox policy allow-lists `offsetget` and `offsetexists` for `Grav\Common\User\Interfaces\UserInterface`. The concrete `Grav\Common\User\DataUser\User` class does not filter which fields `offsetGet()` returns, so any sandboxed template with access to a `User` object can read `hashed_password`, `secret` (2FA seed), and `twofa_secret` directly, bypassing the redaction Grav's own code applies everywhere else.

## The core evidence, from Grav's own code

`system/src/Grav/Common/User/DataUser/User.php`:

```php /** * {@inheritdoc} * Override to filter out sensitive fields like password hashes */ public function jsonSerialize(): array { $items = parent::jsonSerialize();

// Security: Remove sensitive fields that should never be exposed to frontend unset($items['hashed_password']); unset($items['secret']); // 2FA secret unset($items['twofa_secret']); // Alternative 2FA field name

return $items; }

public function offsetGet($offset) { $value = parent::offsetGet($offset); // only special-cases 'authorized', nothing else -- no redaction return $value; } ```

`system/config/security.yaml`:

```yaml - class: 'Grav\Common\User\Interfaces\UserInterface' methods: 'authorize, authorized, authenticated, username, fullname, email, language, offsetget, offsetexists' ```

This is the same vulnerability shape as two already-fixed issues in this file (GHSA-j274-39qw-32c9 and GHSA-mc5q-6hpj-rp7j -…