CVE-2026-76846CWE-522

CVE-2026-76846

High · published August 25, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00305 · 22.1th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-08-25T06:16Z
References (3)
https://github.com/getgrav/grav/security/advisories/GHSA-xjw5-q542-3vmr · [email protected]https://www.vulncheck.com/advisories/grav-before-information-disclosure-via-twig-sandbox · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-xjw5-q542-3vmr · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 26 AUG 08:27Z
    EPSS moved — → 0%
    epss
  • 25 AUG 01:30Z
    Grav before 2.0.16 Information Disclosure via Twig Sandbox
    cvelistv5