CVE-2026-72702
Received Received - Intake

Origin Validation Bypass in Grav CMS

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter. An attacker who controls a domain that begins with the victim site's origin (e.g. https://example.com.attacker.tld) can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-72702
EUVD
EUVD-2026-65216

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
grav cms to 2.0.16 (exc)
getgrav grav to 2.0.16 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72702 is an origin validation bypass in Grav CMS versions before 2.0.16. The Uri::referrer() and Pages::referrerRoute() functions incorrectly validate the HTTP Referer header using an unanchored prefix match against the site's base URL. This allows attackers to spoof the referrer by registering domains like example.com.attacker.tld, tricking the application into treating requests from these domains as originating from the legitimate site.

Detection Guidance

To detect this vulnerability, inspect Grav CMS versions for 2.0.15 or earlier. Check server logs for requests with Referer headers containing domains that start with your site's base URL but include additional subdomains or suffixes (e.g., example.com.attacker.tld). Use commands like grep to search logs for suspicious Referer patterns or version checks like 'bin/grav version' in Grav's root directory.

Impact Analysis

This vulnerability could allow attackers to bypass same-origin checks, potentially leading to unauthorized actions, data access, or open redirects. If the vulnerable output is used in redirect flows, it may enable credential phishing by tricking users into entering credentials on attacker-controlled sites.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling unauthorized data access or phishing attacks. If exploited, it may allow attackers to bypass origin checks, potentially leading to credential theft or data exfiltration, which violates confidentiality requirements in both regulations.

Mitigation Strategies

Upgrade Grav CMS to version 2.0.16 or later immediately. If upgrading is not possible, apply the patch from the GitHub advisory by modifying the Uri::referrer() and Pages::referrerRoute() methods to use anchored comparisons with trailing delimiters or parse_url() for robust validation. Monitor network traffic for unusual Referer headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72702. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart