{"id":"GHSA-m59h-42jf-cphr","summary":"Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground","details":"Admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other sensitive configuration data, in addition to running the `hashData()` signing function.\n\nThis issue was mitigated in versions 3.7.2 and 2.15.2 by disabling access to the Sprig Playground entirely when `devMode` is disabled, by default. It is possible to override this behaviour using a new `enablePlaygroundWhenDevModeDisabled` that defaults to `false`.\n\nReferences:\n\n- https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475\n- https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b","aliases":["CVE-2026-27131"],"modified":"2026-03-30T14:07:21.308344Z","published":"2026-03-23T20:25:37Z","database_specific":{"nvd_published_at":"2026-03-23T20:16:25Z","cwe_ids":["CWE-200","CWE-489"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-03-23T20:25:37Z"},"references":[{"type":"WEB","url":"https://github.com/putyourlightson/craft-sprig/security/advisories/GHSA-m59h-42jf-cphr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27131"},{"type":"WEB","url":"https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b"},{"type":"WEB","url":"https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475"},{"type":"PACKAGE","url":"https://github.com/putyourlightson/craft-sprig"}],"affected":[{"package":{"name":"putyourlightson/craft-sprig","ecosystem":"Packagist","purl":"pkg:composer/putyourlightson/craft-sprig"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.15.2"}]}],"versions":["2.0.0","2.0.1","2.1.0","2.10.0","2.10.1","2.11.0","2.12.0","2.13.0","2.13.1","2.14.0","2.14.1","2.15.0","2.15.1","2.2.0","2.2.1","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.7.2","2.7.3","2.8.0","2.8.1","2.9.0","2.9.0-beta.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-m59h-42jf-cphr/GHSA-m59h-42jf-cphr.json"}},{"package":{"name":"putyourlightson/craft-sprig","ecosystem":"Packagist","purl":"pkg:composer/putyourlightson/craft-sprig"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.7.2"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.1.0","3.1.0-beta.1","3.2.0","3.2.1","3.3.0","3.4.0","3.5.0","3.5.1","3.5.2","3.6.0","3.6.1","3.7.0","3.7.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-m59h-42jf-cphr/GHSA-m59h-42jf-cphr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"}]}