CVE-2026-72701: Grav CMS CSRF Timing Vulnerability

CVE-2026-72701 Overview

CVE-2026-72701 is a timing side-channel vulnerability in Grav CMS versions before 2.0.16. The flaw resides in the Utils::verifyNonce() function, which validates Cross-Site Request Forgery (CSRF) nonces using the non-constant-time === string comparison operator instead of hash_equals(). Attackers can measure response timing differences across many requests to recover valid nonce values byte-by-byte, weakening CSRF protection below its intended security margin. The weakness is categorized as [CWE-208] Observable Timing Discrepancy.

Critical Impact
Remote attackers can incrementally recover CSRF nonces through timing analysis, enabling forged state-changing requests against authenticated Grav CMS administrators.

Affected Products

Grav CMS versions prior to 2.0.16
Grav CMS installations relying on Utils::verifyNonce() for CSRF validation
Any Grav CMS deployment exposed over untrusted networks

Discovery Timeline

2026-08-25 - CVE-2026-72701 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-72701

Vulnerability Analysis

The vulnerability affects CSRF nonce validation inside Grav CMS. The Utils::verifyNonce() function compares a submitted nonce against the expected value using PHP's === operator. In PHP, string comparison with === terminates as soon as a differing byte is detected, producing measurable response-time differences that correlate with the number of matching leading bytes.

An attacker who can issue authenticated or unauthenticated requests to a Grav CMS endpoint that triggers nonce verification can send crafted candidate nonces and measure server response latency. Over many requests, the attacker infers each nonce byte, then advances to the next position. Once a valid nonce is recovered, standard CSRF-defended actions can be forged against a targeted administrator session.

Root Cause

The root cause is the use of non-constant-time comparison for a security-sensitive secret. Constant-time comparison functions such as PHP's hash_equals() are designed to execute in time independent of matching byte positions. Substituting === for such a function introduces an observable timing discrepancy in the authentication surface of the CSRF token.

Attack Vector

Exploitation is performed remotely over the network without authentication or user interaction, though attack complexity is elevated because reliable timing measurement requires many repeated requests and statistical analysis to filter network jitter. The impact is limited to integrity: successful exploitation weakens CSRF protection and enables forged administrative actions rather than direct code execution or data disclosure.

No public proof-of-concept exploit is listed in the enriched data. See the GitHub Security Advisory GHSA-38p6-h87p-r4cg and the VulnCheck Advisory - Grav CMS Timing Attack for technical detail.

Detection Methods for CVE-2026-72701

Indicators of Compromise

High-volume, low-variance repeated POST or GET requests to Grav administrative endpoints that require CSRF nonces, originating from a single source or a small set of sources.
Sequential requests containing systematically varying nonce parameters that differ by one byte at a time.
Elevated request rates from clients that never complete a valid state-changing action despite continuous submissions.

Detection Strategies

Instrument web application firewalls (WAF) and reverse proxies to flag repeated requests with malformed or brute-force-shaped nonce values against Grav routes.
Alert on statistical anomalies in per-source request volume against /admin endpoints in Grav CMS.
Correlate application logs with server response-time metrics to identify timing-probe patterns.

Monitoring Recommendations

Enable verbose access logging for all Grav CMS administrative routes and forward logs to a centralized SIEM.
Track failed CSRF validation events as a first-class metric and alert on sustained failure rates.
Monitor outbound egress from Grav-hosting servers for anomalous activity that could indicate post-exploitation abuse of a forged administrative action.

How to Mitigate CVE-2026-72701

Immediate Actions Required

Upgrade Grav CMS to version 2.0.16 or later on all instances.
Restrict network access to Grav administrative endpoints to trusted IP ranges where feasible.
Rotate any long-lived administrative sessions and force re-authentication after upgrade.

Patch Information

The fix is included in Grav CMS 2.0.16. The upstream patch replaces the non-constant-time === comparison in Utils::verifyNonce() with PHP's hash_equals() function, which executes in time independent of input contents. Refer to the GitHub Security Advisory GHSA-38p6-h87p-r4cg for release details and the VulnCheck Advisory - Grav CMS Timing Attack for additional context.

Workarounds

Place Grav CMS administrative endpoints behind a VPN or authenticated reverse proxy to reduce exposure to remote timing probes.
Deploy WAF rate-limiting rules that throttle repeated requests to nonce-protected routes from a single source.
Enforce short administrative session lifetimes and re-issue CSRF nonces frequently to reduce the window available for timing recovery.

bash

# Configuration example: upgrade Grav CMS via the bundled CLI
php bin/gpm selfupgrade
php bin/gpm version grav
# Confirm the reported version is 2.0.16 or later