{"id":"GHSA-m59h-42jf-cphr","aliases":["CVE-2026-27131"],"title":"Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground","description":"Admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other sensitive configuration data, in addition to running the `hashData()` signing function.\n\nThis issue was mitigated in versions 3.7.2 and 2.15.2 by disabling access to the Sprig Playground entirely when `devMode` is disabled, by default. It is possible to override this behaviour using a new `enablePlaygroundWhenDevModeDisabled` that defaults to `false`.\n\nReferences:\n\n- https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475\n- https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b","severity":"medium","score":5.5,"published":"2026-03-23T20:25:37.000Z","modified":"2026-03-30T14:07:21.308Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"putyourlightson/craft-sprig","ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.15.2"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.1","2.1.0","2.10.0","2.10.1","2.11.0","2.12.0","2.13.0","2.13.1","2.14.0","2.14.1","2.15.0","2.15.1","2.2.0","2.2.1","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.7.2","2.7.3","2.8.0","2.8.1","2.9.0","2.9.0-beta.1"],"fixed":["2.15.2"]},{"ecosystem":"Packagist","name":"putyourlightson/craft-sprig","ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.7.2"}],"type":"ECOSYSTEM"}],"versions":["3.0.0","3.0.1","3.0.2","3.1.0","3.1.0-beta.1","3.2.0","3.2.1","3.3.0","3.4.0","3.5.0","3.5.1","3.5.2","3.6.0","3.6.1","3.7.0","3.7.1"],"fixed":["3.7.2"]}],"sourceAffected":[],"references":["https://github.com/putyourlightson/craft-sprig/security/advisories/GHSA-m59h-42jf-cphr","https://nvd.nist.gov/vuln/detail/CVE-2026-27131","https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b","https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475","https://github.com/putyourlightson/craft-sprig"],"sources":[{"name":"OSV","id":"GHSA-m59h-42jf-cphr","modified":"2026-03-30T14:07:21.308344Z","url":"https://osv.dev/vulnerability/GHSA-m59h-42jf-cphr"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","score":5.5}]}