Vulnerability in Grav File-based Web Platform Affects User Permissions

CVE-2026-42610

What is CVE-2026-42610?

Grav, a popular file-based web platform, prior to version 2.0.0-beta.2, contains a vulnerability that allows low-privileged users, such as content editors with limited permissions, to bypass the Twig sandbox restrictions. By leveraging the grav['accounts'] service, an attacker can programmatically access administrative user objects, enabling the extraction of sensitive data, including Bcrypt password hashes and security salts. This significant oversight puts user data at risk, making timely upgrades crucial to maintain security.

References