CVE-2026-27131

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27131", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-17T18:42:27.044Z", "datePublished": "2026-03-23T19:04:37.417Z", "dateUpdated": "2026-03-24T14:09:08.984Z"}, "containers": {"cna": {"title": "Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-489", "lang": "en", "description": "CWE-489: Active Debug Code", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/putyourlightson/craft-sprig/security/advisories/GHSA-m59h-42jf-cphr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/putyourlightson/craft-sprig/security/advisories/GHSA-m59h-42jf-cphr"}, {"name": "https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b", "tags": ["x_refsource_MISC"], "url": "https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b"}, {"name": "https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475", "tags": ["x_refsource_MISC"], "url": "https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475"}], "affected": [{"vendor": "putyourlightson", "product": "craft-sprig", "versions": [{"version": ">= 3.0.0, < 3.15.2", "status": "affected"}, {"version": ">= 2.0.0, < 2.15.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-23T19:04:37.417Z"}, "descriptions": [{"lang": "en", "value": "The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other sensitive configuration data, in addition to running the `hashData()` signing function. This issue was mitigated in versions 3.15.2 and 2.15.2 by disabling access to the Sprig Playground entirely when `devMode` is disabled, by default. It is possible to override this behavior using a new `enablePlaygroundWhenDevModeDisabled` that defaults to `false`."}], "source": {"advisory": "GHSA-m59h-42jf-cphr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T14:08:58.187517Z", "id": "CVE-2026-27131", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:09:08.984Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27131", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T14:08:58.187517Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:09:01.527Z"}}], "cna": {"title": "Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground", "source": {"advisory": "GHSA-m59h-42jf-cphr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "putyourlightson", "product": "craft-sprig", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.15.2"}, {"status": "affected", "version": ">= 2.0.0, < 2.15.2"}]}], "references": [{"url": "https://github.com/putyourlightson/craft-sprig/security/advisories/GHSA-m59h-42jf-cphr", "name": "https://github.com/putyourlightson/craft-sprig/security/advisories/GHSA-m59h-42jf-cphr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b", "name": "https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475", "name": "https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other sensitive configuration data, in addition to running the `hashData()` signing function. This issue was mitigated in versions 3.15.2 and 2.15.2 by disabling access to the Sprig Playground entirely when `devMode` is disabled, by default. It is possible to override this behavior using a new `enablePlaygroundWhenDevModeDisabled` that defaults to `false`."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-489", "description": "CWE-489: Active Debug Code"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-23T19:04:37.417Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27131", "state": "PUBLISHED", "dateUpdated": "2026-03-24T14:09:08.984Z", "dateReserved": "2026-02-17T18:42:27.044Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-23T19:04:37.417Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "craft-sprig", "vendor": "putyourlightson", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.15.2"}, {"status": "affected", "version": ">= 2.0.0, < 2.15.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other sensitive configuration data, in addition to running the `hashData()` signing function. This issue was mitigated in versions 3.15.2 and 2.15.2 by disabling access to the Sprig Playground entirely when `devMode` is disabled, by default. It is possible to override this behavior using a new `enablePlaygroundWhenDevModeDisabled` that defaults to `false`."}, {"lang": "es", "value": "El plugin Sprig para Craft CMS es un framework de componentes Twig reactivo para Craft CMS. A partir de la versi\u00f3n 2.0.0 y antes de las versiones 2.15.2 y 3.15.2, los usuarios administradores, y los usuarios con permiso expl\u00edcito para acceder al Sprig Playground, podr\u00edan exponer potencialmente la clave de seguridad, las credenciales y otros datos de configuraci\u00f3n sensibles, adem\u00e1s de ejecutar la funci\u00f3n de firma 'hashData()'. Este problema se mitig\u00f3 en las versiones 3.15.2 y 2.15.2 al deshabilitar completamente el acceso al Sprig Playground cuando 'devMode' est\u00e1 deshabilitado, por defecto. Es posible anular este comportamiento utilizando una nueva 'enablePlaygroundWhenDevModeDisabled' que por defecto es 'false'."}], "id": "CVE-2026-27131", "lastModified": "2026-06-17T10:26:43.367", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27131", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T14:08:58.187517Z", "version": "2.0.3"}}]}, "published": "2026-03-23T20:16:25.240", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b"}, {"source": "security-advisories@github.com", "url": "https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475"}, {"source": "security-advisories@github.com", "url": "https://github.com/putyourlightson/craft-sprig/security/advisories/GHSA-m59h-42jf-cphr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-489"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.15.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.15.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "craft-sprig", "source": "cna", "vendor": "putyourlightson"}, "product": "craft-sprig", "vendor": "putyourlightson"}], "analysis": {"en": {"generated_at": "2026-03-23T20:22:57.314913+00:00", "value": {"mitigation_remediation": ["Upgrade the Sprig plugin to version 2.15.2 or newer, or version 3.15.2 or newer."], "summary": {"action": "Apply Patch", "impact": "Sensitive Data Exposure"}, "threat_synthesis": {"affected_systems": "The Sprig plugin for Craft CMS is affected. Versions from 2.0.0 up to 2.15.1 and from 3.0.0 up to 3.15.1 are vulnerable. The issue does not affect earlier releases or later patched versions such as 2.15.2, 3.15.2 and newer.", "description_and_impact": "This vulnerability allows an attacker who can access the Sprig Playground to view sensitive configuration data, including the security key and credentials, and to use the hashData() signing function. The weakness is a disclosure of information that can be leveraged for credential compromise or forging signatures, meeting CWE\u2011200 and CWE\u2011489 criteria. The potential impact includes unauthorized access to protected resources, breaking of authentication flows, and possible escalation of privileges.", "risk_and_exploitability": "The CVSS score of 5.5 indicates a moderate severity, but the presence of useful default access for admin users means the exploitability is non\u2011negligible. No EPSS score is available, and the vulnerability is not listed in the KEV catalog. The likely attack vector is through a session with admin or authorised explorer access to the Sprig Playground; an attacker can read and exploit exposed keys or run the signing function to forge data."}}}}, "created": "2026-03-24T10:33:07.668097+00:00", "updated": "2026-03-25T20:36:58.720973+00:00", "vendors": ["putyourlightson", "putyourlightson$PRODUCT$craft-sprig"]}