Which versions of Grav CMS are affected by CVE-2026-72702?

Grav CMS versions before 2.0.16 contain a critical origin validation bypass allowing remote attackers to forge requests from attacker-controlled look-alike domains (no public exploit identified at…. A patch is available.

How to fix or mitigate CVE-2026-72702?

Within 24 hours, identify all Grav CMS instances in your environment and document their current versions. Within 7 days, upgrade all instances to Grav CMS 2.0.16 or later to apply the vendor patch. Within 30 days, verify upgrade completion and audit logs for evidence of exploitation attempts, specifically searching for unusual Referer headers or cross-origin POST requests to protected routes.

Grav CMS CVE-2026-72702

Q: What is the CVSS score of CVE-2026-72702?

CVE-2026-72702 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-65216 CRITICAL

Origin Validation Error (CWE-346)

2026-08-25 VulnCheck

GHSA-qh7h-6c7g-x8m6

Authentication Bypass Grav Getgrav

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Referer is attacker-forgeable in direct requests so PR:N/UI:N/AC:L; impact is primarily integrity via bypassed origin/CSRF gating (I:H), with limited confidentiality and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:N/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 25, 2026 - 03:16 EUVD

Analysis Generated

Aug 25, 2026 - 02:24 vuln.today

CVE Published

Aug 25, 2026 - 01:30 cve.org

CRITICAL 9.3

DescriptionCVE.org

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter. An attacker who controls a domain that begins with the victim site's origin (e.g. https://example.com.attacker.tld) can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.

AnalysisAI

Origin validation bypass in Grav CMS before 2.0.16 lets remote attackers defeat the Referer-based same-origin check used by the Uri::referrer() and Pages::referrerRoute() methods. Because the check uses an unanchored str_starts_with() prefix match without a trailing delimiter, a request bearing a Referer from an attacker-controlled look-alike domain (e.g. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target route relies on the vulnerable Referer-based origin validation in Uri::referrer() or Pages::referrerRoute(), and that the attacker can present a Referer value beginning with the victim site's base origin - achievable either by directly setting the Referer header in a scripted request or by controlling a domain that starts with the victim origin (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The supplied CVSS 4.0 vector (9.3, AV:N/AC:L/PR:N/UI:N with VC:H/VI:H/VA:H) rates this Critical, treating it as a fully unauthenticated network attack with high confidentiality, integrity and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade Grav CMS to 2.0.16 or later, which anchors the origin comparison correctly. … Detailed patch versions, workarounds, and compensating controls in full report.