https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:15:32 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-358812 EUVD-2026-358812 https://cve.radiocsirt.org/vuln/euvd-2026-358812 https://cve.radiocsirt.org/vuln/fkie_cve-2026-76839 <p>Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering. Attackers with page-edit permissions can call offsetGet() on User objects to extract hashed passwords and 2FA secrets, enabling offline password cracking and authentication bypass.</p> <p>Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering. Attackers with page-edit permissions can call offsetGet() on User objects to extract hashed passwords and 2FA secrets, enabling offline password cracking and authentication bypass.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-76839 https://cve.radiocsirt.org/vuln/ghsa-3jhr-mxmx-38cx <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>## Summary</p> <p>`system/config/security.yaml`&#39;s Twig sandbox policy allow-lists `offsetget` and `offsetexists` for `Grav\Common\User\Interfaces\UserInterface`. The concrete `Grav\Common\User\DataUser\User` class does not filter which fields `offsetGet()` returns, so any sandboxed template with access to a `User` object can read `hashed_password`, `secret` (2FA seed), and `twofa_secret` directly, bypassing the redaction Grav&#39;s own code applies everywhere else.</p> <p>## The core evidence, from Grav&#39;s own code</p> <p>`system/src/Grav/Common/User/DataUser/User.php`:</p> <p>```php /** * {@inheritdoc} * Override to filter out sensitive fields like password hashes */ public function jsonSerialize(): array { $items = parent::jsonSerialize();</p> <p>// Security: Remove sensitive fields that should never be exposed to frontend unset($items[&#39;hashed_password&#39;]); unset($items[&#39;secret&#39;]); // 2FA secret unset($items[&#39;twofa_secret&#39;]); // Alternative 2FA field name</p> <p>return $items; }</p> <p>public function offsetGet($offset) { $value = parent::offsetGet($offset); // only special-cases &#39;authorized&#39;, nothing else -- no redaction return $value; } ```</p> <p>`system/config/security.yaml`:</p> <p>```yaml - class: &#39;Grav\Common\User\Interfaces\UserInterface&#39; methods: &#39;authorize, authorized, authenticated, username, fullname, email, language, offsetget, offsetexists&#39; ```</p> <p>This is the same vulnerability shape as two already-fixed issues in this file (GHSA-j274-39qw-32c9 and GHSA-mc5q-6hpj-rp7j -…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>## Summary</p> <p>`system/config/security.yaml`&#39;s Twig sandbox policy allow-lists `offsetget` and `offsetexists` for `Grav\Common\User\Interfaces\UserInterface`. The concrete `Grav\Common\User\DataUser\User` class does not filter which fields `offsetGet()` returns, so any sandboxed template with access to a `User` object can read `hashed_password`, `secret` (2FA seed), and `twofa_secret` directly, bypassing the redaction Grav&#39;s own code applies everywhere else.</p> <p>## The core evidence, from Grav&#39;s own code</p> <p>`system/src/Grav/Common/User/DataUser/User.php`:</p> <p>```php /** * {@inheritdoc} * Override to filter out sensitive fields like password hashes */ public function jsonSerialize(): array { $items = parent::jsonSerialize();</p> <p>// Security: Remove sensitive fields that should never be exposed to frontend unset($items[&#39;hashed_password&#39;]); unset($items[&#39;secret&#39;]); // 2FA secret unset($items[&#39;twofa_secret&#39;]); // Alternative 2FA field name</p> <p>return $items; }</p> <p>public function offsetGet($offset) { $value = parent::offsetGet($offset); // only special-cases &#39;authorized&#39;, nothing else -- no redaction return $value; } ```</p> <p>`system/config/security.yaml`:</p> <p>```yaml - class: &#39;Grav\Common\User\Interfaces\UserInterface&#39; methods: &#39;authorize, authorized, authenticated, username, fullname, email, language, offsetget, offsetexists&#39; ```</p> <p>This is the same vulnerability shape as two already-fixed issues in this file (GHSA-j274-39qw-32c9 and GHSA-mc5q-6hpj-rp7j -…</p> https://cve.radiocsirt.org/vuln/ghsa-3jhr-mxmx-38cx