CVE-2026-72702 Grav CMS before 2.0.16 Origin Validation Bypass via Referer
Attackers can bypass origin validation in Grav CMS by spoofing the Referer header, allowing same-origin trust for malicious domains.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72702?
CVE-2026-72702 is a critical vulnerability in getgrav grav, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter. An attacker who controls a domain that begins with the victim site's origin (e.g. https://example.com.attacker.tld) can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.
Weakness: CWE-346
Which versions are affected by CVE-2026-72702?
2 open source packages ship an affected version, including getgrav/grav.
| Package | Affected | Fixed in |
|---|---|---|
getgrav/grav Packagist | All versions | 2.0.16 |
getgrav/grav Packagist | All versions | 2.0.16 |
How do I fix CVE-2026-72702?
Upgrade getgrav/grav to 2.0.16 or later.
Is CVE-2026-72702 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72702 exists.
Sources
Also known as GHSA-9ccq-2jfg-qw33.