Skip to main content

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2026-44738

High
7.7/10

Summary

Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) into the rendered HTML. No administrator privileges are required. This vulnerability is fixed in 2.0.0-rc.2.

  • LOW
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-200 - Information Exposure

An information exposure vulnerability is categorized as an information flow (IF) weakness, which can potentially allow unauthorized access to otherwise classified information in the application, such as confidential personal information (demographics, financials, health records, etc.), business secrets, and the application's internal environment.

References

Advisory Timeline

  • Published