Grav CMS Sensitive Information Disclosure via Accounts Service Bypass in Twig Sandbox (CVE-2025-42610)

Vulnerability Summary: Grav CMS Sensitive Information Disclosure Vulnerability Overview Title: Sensitive Information Disclosure via Accounts Service Bypass CVE ID: CVE-2025-42610 Severity: Moderate (6.5/10) Published: 2026-04-24 Description: An information disclosure vulnerability exists in Grav CMS v1.8.0-beta.29. Despite previous security patches (specifically v1.8.0-beta.27/28) aimed at restricting access to sensitive objects within the Twig environment, the Accounts service remains exposed. Low-privileged users (e.g., a Content Editor with only page update permissions) can bypass existing Twig sandbox restrictions by exploiting the service. Attackers can programmatically load administrator user objects and extract sensitive data, including Bcrypt password hashes and security salt. Impact Affected Versions: Grav CMS v1.8.0-beta.29 (and earlier 1.8.x beta versions) Impact: Attackers can obtain password hashes for all registered users, including super administrators. The extracted hashes can be used for offline brute-force or dictionary attacks. Remediation Fixed Version: 2.0.0-beta.2 Fix Status: Fixed (Maintainer note confirms fix applied) Remediation Details: - The HMAAC key (previously stored in ) has been moved to in . - During upgrade, existing salt values are migrated to the new file. - Calling from a sandboxed Twig template now returns null. - The extension is blocked by the default access rule. - The password hash extraction method in the PoC is now covered by the new Twig content sandbox in 2.0.0-beta.2. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Grav CMS Sensitive Information Disclosure via Accounts Service Bypass in Twig Sandbox (CVE-2025-42610)

More from this source