PT-2026-37276 · Grav · Grav

Samer666569 · Published 2026-05-05 · Updated 2026-05-11 · CVE-2026-42610

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.0-beta.2

Description A low-privileged user, such as a Content Editor with pages.update permissions, can bypass Twig sandbox restrictions by utilizing the grav['accounts'] service. This allows an attacker to programmatically load administrative user objects and extract sensitive data, including Bcrypt password hashes and the security salt. This is achieved by accessing the internal service container to bypass the isDangerousFunction filter.

Recommendations Update to version 2.0.0-beta.2 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-42610

GHSA-3F29-PQWF-V4J4

Affected Products

Grav

References · 8

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-3f29-pqwf-v4j4 · Exploit
• https://github.com/getgrav/grav/commit/c66dfeb5ff679a1667678c6335eb9ff3255dfc47 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42610 · Security Note
• https://osv.dev/vulnerability/GHSA-3f29-pqwf-v4j4 · Vendor Advisory
• https://github.com/getgrav/grav · Note
• https://twitter.com/VulmonFeeds/status/2053938674526572974 · Twitter Post
• https://twitter.com/infoflowcloud/status/2053933330626756890 · Twitter Post
• https://twitter.com/CVEnew/status/2053932468101878165 · Twitter Post