Grav CMS CVE-2026-76846

Two conditions must be simultaneously present: (1) the attacker must possess a Grav account with page-edit permission - a non-default delegated role required for multi-user or contributor-based deployments - and (2) the config_access feature must be explicitly enabled in the Grav configuration, as it is not on by default. Without config_access enabled, the config object is not exposed to Twig templates regardless of denylist gaps. Exploitation is therefore not possible against single-operator installations, read-only public sites, or deployments where page-edit rights are not granted to untrusted parties. The primary threat model is insider threat, compromised editor credentials, or misconfigured multi-tenant Grav instances where contributor roles are delegated broadly.

The provided CVSS 4.0 vector assigns PR:N (no privileges required), which directly contradicts the CVE description's explicit requirement for page-edit permission - this discrepancy should be verified against the vendor advisory before using the published score for prioritization decisions. Even a mid-sized municipal IT team in malbork running Grav with delegated content editors and a Redis backend should treat this as a meaningful priority, since exposure of Redis credentials enables lateral movement well beyond the CMS itself. Despite the headline 8.7 score, real-world exploitability is bounded by two concurrent prerequisites: an authenticated account with page-edit rights and the non-default config_access feature being enabled. No EPSS data was provided, the vulnerability is absent from CISA KEV, and no public exploit code is referenced in the available intelligence - these signals together indicate a lower urgency than the CVSS score alone suggests, primarily relevant to multi-editor or contributor-facing deployments rather than single-operator installations.

An attacker who holds a content-editor account on a Grav deployment with config_access enabled inserts {{ config.get('system.cache.redis.password') }} into a Twig template for a page they control. Upon previewing or publishing the page, the Twig sandbox fails to block the call and the Redis password is returned in the rendered HTML. The attacker can then authenticate directly to the Redis service to read cached data, forge session tokens, or pivot further into the backend infrastructure. No public exploit code is confirmed at time of analysis.