CVE-2026-72782 craftcms CVE debrief

Who should care

Organizations using affected versions of Craft CMS (versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2) should prioritize patching this vulnerability. Specifically, developers, system administrators, and security teams responsible for managing Craft CMS installations should be aware of the potential risks and take immediate action to protect their environments.

Technical summary

CVE-2026-72782 is a high-severity vulnerability (CVSS 7.1) in Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2. The vulnerability allows authenticated attackers with control panel access to interpolate environment variables and secrets into Twig templates, even when the Twig sandbox is enabled. Using a blind error-based technique across multiple requests, attackers can incrementally leak arbitrary environment variables and secrets. This can lead to session forgery (via CRAFT_SECURITY_KEY), privilege escalation, and theft of database, SMTP, API, or blob storage credentials. The vulnerability is addressed in Craft CMS versions 5.10.6 and 4.18.2.

Defensive priority

Authenticated attackers with control panel access can exploit this vulnerability to leak environment variables and secrets, potentially leading to privilege escalation and credential theft.

Recommended defensive actions

• Inventory and verify affected Craft CMS versions, applying vendor patches (5.10.6 or 4.18.2) as needed.
• Restrict control panel access to trusted users and consider implementing additional monitoring for suspicious Twig template rendering activity.
• Review and rotate sensitive credentials (e.g., CRAFT_SECURITY_KEY, database, SMTP, API, blob storage) as a precautionary measure.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-72782 record indicates that Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 are vulnerable to environment variable and secret leakage via Twig template rendering. An authenticated attacker with control panel access can exploit this using a blind error-based technique. The vulnerability allows incremental leakage of arbitrary environment variables and secrets, which can be abused for session forgery, privilege escalation, and credential theft. Fixes are available in versions 5.10.6 and 4.18.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.