{"vulnerability": "cve-2026-72702", "sightings": [{"uuid": "eb84cb57-6af1-412b-a9ce-27d685a21b23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72702", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtutsbu6id25", "content": "CVE-2026-72702 - grav\nWebsites that run Grav CMS versions before 2.0.16 may accept requests that appear to come from the same site when they actually originate from an attacker\u2019s domain. This happens because\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#grav #getgrav #CVE #infosec", "creation_timestamp": "2026-08-25T03:10:06.012054Z"}, {"uuid": "05b3ed68-9ef2-4f7d-9bd3-63f203f476a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72702", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtuwzzyhhc2c", "content": "\ud83d\udea8 CVE-2026-72702 \u2014 CVSS 9.3 CRITICAL\n\nGrav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-72702\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-25T04:08:07.790355Z"}, {"uuid": "bd04c79b-6b7a-4437-97db-7701d051317b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-72702", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117154265387278343", "content": "CVE-2026-72702 | Grav CMS <2.0.16 | CRITICAL (CVSS 9.3): Origin validation bypass via weak Referer checks lets attackers defeat CSRF defenses. No fix confirmed \u2014 use extra controls, monitor vendor updates. https://radar.offseq.com/threat/cve-2026-72702-origin-validation-error-in-getgrav-grav-4b8f0ff64f944a7c #OffSeq #CVE202672702 #GravCMS #WebSecurity", "creation_timestamp": "2026-08-25T04:30:24.074721Z"}, {"uuid": "40844234-34f1-4960-b72e-d57c32cf5c04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-72702", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtuybw6tuu2e", "content": "Grav CMS <2.0.16 faces a CRITICAL Referer origin validation bug (CVSS 9.3). Attackers can bypass protections like CSRF. No confirmed patch yet \u2014 review your controls. More: https://radar.offseq.com/threat/cve-2026-72702-origin-validation-error-in-getgrav-grav-4b8f0ff64f944a7c #OffSeq #GravCMS #CV...", "creation_timestamp": "2026-08-25T04:30:27.422917Z"}, {"uuid": "b88b5b01-54db-4687-843f-0e5bd0117452", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72702", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtvf4k2ydd2p", "content": "CVE-2026-72702\nWebsites using Grav CMS versions older than 2.0.16 may accept a fake Referer header that looks similar to the site\u2019s own address. This lets an attacker make the system think a request comes from the same site,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-25T08:20:05.278279Z"}]}