Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The Grav CMS package getgrav/grav, versions before 2.0.16, has a non-constant-time comparison in Utils::verifyNonce(), which is used for CSRF nonce checks; the source reports it uses PHP's === operator rather than hash_equals(). An attacker who can send many requests and precisely measure response timing might in principle recover a valid nonce byte by byte, but the source says the timing signal is very small and that it did not demonstrate a practical remote attack. The fix is to upgrade to version 2.0.16.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 6.3 | Medium | 4.0 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | CNA (VulnCheck) |
- CISA KEV Not listed.
- EPSS 0.0022, the 12th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 13:53 UTC First seen by agentprime
- 31 Oct 2026, 13:53 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-38p6-h87p-r4cg
- OSV: GHSA-38p6-h87p-r4cg
- github.com/getgrav/grav/security/advisories/GHSA-38p6-h87p-r4cg
- nvd.nist.gov/vuln/detail/CVE-2026-72701
- github.com/getgrav/grav/commit/a076b9073abc51c1df924529d65773e44950c5c4
- github.com/getgrav/grav
- github.com/getgrav/grav/releases/tag/2.0.16
- www.vulncheck.com/advisories/grav-cms-before-timing-attack-via-verifynonce