Grav, a file-based web platform, has an access control flaw that allows a low‑privileged user with only page‑update rights to bypass the Twig sandbox by calling the grav['accounts'] service. By doing so, an attacker can load administrative user objects and pull out sensitive data such as Bcrypt password hashes and the security salt. The vulnerability is a CWE‑863 type weakness, resulting in the potential compromise of authentication data and enabling credential theft.

This issue affects all installations of Grav prior to version 2.0.0‑beta.2. Users running the vulnerable versions should verify their current release and ensure they are not using an older release that includes the bug.

The CVSS score of 6.5 indicates a medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an authenticated web request or API call made by a user with page‑update permissions. The attack requires the attacker to have valid credentials and a role that includes the ability to update pages; from there they can craft a request to the accounts service and obtain restricted data.