[HIGH] Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

PKSA-f7gk-wxm8-5j49 CVE-2026-76839 GHSA-3jhr-mxmx-38cx

Affected package: getgrav/grav

Affected version: <=2.0.15

Reported by:
GitHub