CVE-2026-72702: Grav CMS Authentication Bypass Vulnerability

CVE-2026-72702 Overview

CVE-2026-72702 is an origin validation bypass in Grav CMS versions before 2.0.16. The vulnerability resides in the Uri::referrer() and Pages::referrerRoute() methods, which validate the HTTP Referer header using an unanchored string prefix match. The check relies on str_starts_with($referrer, $base) without a trailing delimiter, allowing attacker-controlled domains that begin with the victim's origin string to be treated as same-origin. This weakness falls under CWE-346: Origin Validation Error.

Critical Impact
An attacker controlling a domain such as https://example.com.attacker.tld can bypass Referer-based origin checks in Grav CMS, enabling cross-origin requests to be accepted as trusted same-origin traffic.

Affected Products

Grav CMS versions before 2.0.16
Grav installations relying on Uri::referrer() for origin validation
Grav installations relying on Pages::referrerRoute() for routing decisions based on Referer

Discovery Timeline

2026-08-25 - CVE-2026-72702 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-72702

Vulnerability Analysis

Grav CMS uses the HTTP Referer header as an input to decide whether an incoming request originated from the same site. The Uri::referrer() and Pages::referrerRoute() methods compare the incoming Referer value against the site's base URL using str_starts_with($referrer, $base). The comparison does not append a path or delimiter boundary after the base origin. Any URL whose string representation begins with the victim base is accepted, regardless of the true domain hierarchy.

Because the check ignores host-boundary semantics, https://example.com.attacker.tld/path satisfies the prefix condition for a base of https://example.com. Grav then treats the request as coming from itself, which downgrades protections that depend on same-origin assumptions.

Root Cause

The root cause is improper origin validation using unanchored string comparison instead of parsed URL components. Origin equivalence must be established by comparing scheme, host, and port after URL parsing, not by lexical prefix matching. Without a trailing / or explicit host equality check, the prefix test is under-constrained.

Attack Vector

The attack is remote, requires no authentication, and no user interaction. An attacker registers or controls a domain whose fully qualified name begins with the target's origin string, then issues cross-origin requests carrying that domain as the Referer. Any Grav feature that relies on Uri::referrer() or Pages::referrerRoute() for trust decisions, including redirect handling and route selection after form submissions, will accept the request as same-origin.

For implementation details, see the GitHub Security Advisory GHSA-9ccq-2jfg-qw33 and the Vulncheck Advisory on Grav CMS.

Detection Methods for CVE-2026-72702

Indicators of Compromise

Web server access logs containing Referer headers where the host component extends the site's origin with an additional label, such as example.com.attacker.tld.
Requests to admin, form-handler, or redirect endpoints paired with an external Referer that lexically starts with the site's base URL.
Bursts of requests from a single client IP or user agent that alternate between attacker-controlled Referers and authenticated session cookies.

Detection Strategies

Parse the Referer header host in log analysis pipelines and alert when the host does not exactly equal the site FQDN but shares its origin string as a prefix.
Correlate suspicious Referer values with state-changing HTTP methods (POST, PUT, DELETE) against Grav endpoints.
Compare the installed Grav version against 2.0.16 across the fleet using file hash or system/defines.php inspection.

Monitoring Recommendations

Ingest Grav application and web server logs into a centralized analytics platform with Referer parsing and host normalization.
Track outbound DNS resolutions from clients to domains that concatenate the site FQDN with additional labels.
Add a WAF rule to flag requests where the Referer host contains the site FQDN followed by a character other than /, ?, #, or end-of-string.

How to Mitigate CVE-2026-72702

Immediate Actions Required

Upgrade Grav CMS to version 2.0.16 or later on all instances.
Audit web logs for prior requests whose Referer host extends the site origin with an additional DNS label.
Invalidate active administrative sessions after patching to force re-authentication.

Patch Information

The issue is fixed in Grav CMS 2.0.16. The upstream fix replaces the unanchored str_starts_with comparison with a parsed URL comparison that validates scheme, host, and port. Full patch details are published in GitHub Security Advisory GHSA-9ccq-2jfg-qw33.

Workarounds

Deploy a reverse proxy or WAF rule that rejects requests whose Referer host does not exactly match an allow-list of trusted FQDNs.
Strip or normalize the Referer header at the edge before it reaches Grav when the header cannot be validated against a strict host equality check.
Enforce anti-CSRF token validation on all state-changing endpoints so that Referer-based checks are not the sole trust boundary.

bash

# Example nginx snippet: allow only exact host match in Referer for state-changing routes
map $http_referer $referer_host_ok {
    default 0;
    "~^https?://example\.com(/|$|\?|#)" 1;
}

server {
    location ~ ^/(admin|forms)/ {
        if ($request_method ~ ^(POST|PUT|DELETE)$) {
            set $check "$referer_host_ok";
        }
        if ($check = 0) { return 403; }
        proxy_pass http://grav_backend;
    }
}