CVE-2026-76839

EUVD-2026-65219
Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering. Attackers with page-edit permissions can call offsetGet() on User objects to extract hashed passwords and 2FA secrets, enabling offline password cracking and authentication bypass.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 18.99%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
getgravgrav
𝑥
< 2.0.16
CNA
Common Weakness Enumeration
References
https://github.com/getgrav/grav/security/advisories/GHSA-3jhr-mxmx-38cx
https://www.vulncheck.com/advisories/grav-before-information-disclosure-via-offsetget
https://github.com/getgrav/grav/security/advisories/GHSA-3jhr-mxmx-38cx