The vulnerability arises from an unanchored prefix comparison of the HTTP Referer header, allowing an attacker to craft a Referer that starts with the victim site's origin yet has a different domain (e.g., https://example.com.attacker.tld). The same‑origin check, intended to mitigate cross‑site request forgery and other origin‑based protections, is incorrectly satisfied when the prefix matches, thereby granting the attacker the privileges normally reserved for same‑origin requests. This can lead to unintended execution of privileged actions, data disclosure, or further compromise depending on what authentication and permission checks rely on the origin check.

Grav CMS products released before version 2.0.16 from the getgrav:grav vendor are affected. Any site running the legacy Grav CMS prior to the 2.0.16 update is vulnerable.

The CVSS score of 9.3 reflects the high impact of the flaw; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. If an attacker can control a domain that prefixes the victim origin, they can inject a forged Referer header in an HTTP request. This bypass removes the same‑origin safeguard and can be used to perform CSRF or abuse any feature that depends on the origin check. The attack does not require privileged access beyond the ability to send HTTP requests, but it demands control over a domain name that shares the initial characters of the target site's origin.