EUVD-2026-309936

fkie_cve-2026-42610

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig sandbox restrictions by utilizing the grav['accounts'] service. Attacker can programmatically load administrative user objects and extract sensitive data, including Bcrypt password hashes and the security salt. This vulnerability is fixed in 2.0.0-beta.2.

GHSA-3f29-pqwf-v4j4 — Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass

Affected: Packagist: getgrav/grav

## Summary Information disclosure exists in `Grav CMS v1.8.0-beta.29`. Despite previous security patches (notably in `v1.8.0-beta.27/28`) aimed at restricting sensitive object access within the Twig environment, the Accounts Service remains exposed.

A low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig sandbox restrictions by utilizing the `grav['accounts']` service. Attacker can programmatically load administrative user objects and extract sensitive data, including Bcrypt password hashes and the security salt.

## Affected version Grav CMS: `v1.8.0-beta.29` (and earlier 1.8.x beta versions).

Note: This vulnerability persists even after the vendor attempted to mitigate similar SSTI vectors in earlier beta releases.

## Steps to Reproduce 1. Create a low-privileged account (MY CASE IS 'editor_chen') with permissions limited to admin.login and basic page management (create, update, list). Ensure all administrative permissions (Configuration, User Accounts, ...) are explicitly Denied.

2. Login to the Admin panel using `editor_chen`. Navigate to Pages and edit the `Home` page.

3. Under the Advanced tab, ensure Process Twig is enabled .

4. In the Content tab, inject the following Twig payload designed to bypass the `isDangerousFunction` filter by accessing the internal service container: ``` --- title: Information Disclosure Test process: twig: true --- # Security Audit Results - Admin Password Hash: {{ grav['account…

Most recent entries from all

EUVD-2026-309936

fkie_cve-2026-42610

GHSA-3f29-pqwf-v4j4 — Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass