Grav CMS CVE-2026-72701

The attacker must be able to send a large volume of HTTP requests directly to the Grav CMS nonce validation endpoint and measure response timing with sub-millisecond precision - feasible from low-latency network positions such as co-located infrastructure or LAN, but difficult over high-jitter internet paths. No authentication is required for the attacker to probe the nonce oracle. No special non-default Grav configuration is required; the flaw exists in the default CSRF validation path used whenever nonce-protected forms are processed. Exploitation is limited by the need for statistical noise reduction across many requests, the availability of a network path with stable, low latency, and the fact that forged requests only produce meaningful impact if a legitimate admin session is active at the time the forged action is submitted.

The CVSS 4.0 score of 6.3 with AV:N/AC:H/AT:P/PR:N/UI:N accurately reflects a network-reachable but technically demanding attack. AC:H and AT:P capture the core constraint: timing attacks require a high volume of requests and sub-millisecond measurement precision, which network jitter in internet-facing deployments can mask. Integrity impact is low (VI:L), bounded to bypassing CSRF protection without code execution or data exfiltration. No CISA KEV listing and no known public exploit code reduce operational urgency. EPSS data was not provided, so exploitation probability must be inferred as low-to-moderate given the attack complexity. Real-world risk is highest for Grav installations reachable from low-latency attacker positions (co-located cloud infrastructure, same datacenter) and lowest for sites behind high-latency internet paths. The fix is low-risk and trivial to apply, making deferral hard to justify.

An attacker with low-latency network access to the Grav admin endpoint sends thousands of HTTP POST requests with systematically varied CSRF nonce guesses, measuring response latency for each candidate at every byte position. Using statistical comparison to identify which guesses produce marginally longer response times, the attacker reconstructs a valid nonce byte-by-byte and then submits a forged state-changing request - such as creating an admin account or modifying site content - that the server accepts as CSRF-validated. No public proof-of-concept code has been identified at time of analysis.