CVE-2026-42610

Published: May 11, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig sandbox restrictions by utilizing the grav['accounts'] service. Attacker can programmatically load administrative user objects and extract sensitive data, including Bcrypt password hashes and the security salt. This vulnerability is fixed in 2.0.0-beta.2.

Affected (2)

Products: Getgrav: Grav

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Getgrav Grav	Up to 1.8.0
Getgrav Grav	Version 2.0.0 beta1

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (3)

https://github.com/getgrav/grav/commit/c66dfeb5ff679a1667678c6335eb9ff3255dfc47

Source: security-advisories@github.com

Patch

https://github.com/getgrav/grav/security/advisories/GHSA-3f29-pqwf-v4j4

Source: security-advisories@github.com

ExploitPatchVendor Advisory

https://github.com/getgrav/grav/security/advisories/GHSA-3f29-pqwf-v4j4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitPatchVendor Advisory

Timeline

No history available yet.