In Grav versions prior to 2.0.0-rc.2, the Twig sandbox allow‑list permits any editor‑role user (admin.pages) to invoke Config::toArray() within a page body. This call returns the entire merged site configuration, exposing plugin secrets such as SMTP passwords, AWS keys, OAuth client secrets, and API tokens directly in the rendered HTML. The vulnerability allows an attacker to exfiltrate highly sensitive data without requiring administrator privileges, thereby compromising confidentiality.

All installations of getgrav:grav older than 2.0.0‑rc.2 are affected. Administrators who have granted the admin.pages role to editors or other users can exploit this flaw. The issue is resolved in version 2.0.0‑rc.2 and later.

The CVSS score is 7.7, indicating a high risk to confidentiality. EPSS is reported as less than 1%, implying a very low probability of exploitation, but the lack of an administrator requirement and the accessibility from any editor role suggest a realistic threat. The vulnerability is not listed in CISA KEV, yet the exposure of credentials can lead to significant downstream impacts if the plugin secrets are compromised.