CVE-2026-72702: Origin Validation Error in getgrav grav
Grav CMS versions before 2.0.16 have an origin validation bypass vulnerability in the Uri::referrer() and Pages::referrerRoute() methods. These methods validate the Referer header using an unanchored string prefix match without a trailing delimiter, allowing an attacker controlling a domain starting with the victim's origin to bypass origin checks.
AI Analysis
Technical Summary
The vulnerability in Grav CMS prior to version 2.0.16 involves improper origin validation in the Uri::referrer() and Pages::referrerRoute() methods. The Referer header is validated using a prefix match (str_starts_with) without anchoring or a trailing delimiter, which means an attacker controlling a domain such as https://example.com.attacker.tld can craft a Referer header that is incorrectly treated as same-origin. This bypasses the Referer-based origin check, potentially allowing unauthorized actions that rely on origin validation.
Potential Impact
This vulnerability allows an attacker to bypass origin validation checks based on the Referer header, potentially enabling unauthorized cross-origin requests to be treated as same-origin. This could lead to security issues where origin-based protections are relied upon, such as CSRF defenses or access controls tied to origin verification.
Mitigation Recommendations
No official fix or patch is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about relying solely on Referer header origin validation and consider additional protective measures.
CVE-2026-72702: Origin Validation Error in getgrav grav
Description
Grav CMS versions before 2.0.16 have an origin validation bypass vulnerability in the Uri::referrer() and Pages::referrerRoute() methods. These methods validate the Referer header using an unanchored string prefix match without a trailing delimiter, allowing an attacker controlling a domain starting with the victim's origin to bypass origin checks.
CVSS v4.0
Score 9.3critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Grav CMS prior to version 2.0.16 involves improper origin validation in the Uri::referrer() and Pages::referrerRoute() methods. The Referer header is validated using a prefix match (str_starts_with) without anchoring or a trailing delimiter, which means an attacker controlling a domain such as https://example.com.attacker.tld can craft a Referer header that is incorrectly treated as same-origin. This bypasses the Referer-based origin check, potentially allowing unauthorized actions that rely on origin validation.
Potential Impact
This vulnerability allows an attacker to bypass origin validation checks based on the Referer header, potentially enabling unauthorized cross-origin requests to be treated as same-origin. This could lead to security issues where origin-based protections are relied upon, such as CSRF defenses or access controls tied to origin verification.
Mitigation Recommendations
No official fix or patch is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about relying solely on Referer header origin validation and consider additional protective measures.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-10T13:02:20.829Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a8cf57bacd9273b498428a8
Added to database: 08/25/2026, 01:52:59 UTC
Last enriched: 08/25/2026, 02:08:11 UTC
Last updated: 08/25/2026, 02:54:14 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.