Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-114659

Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

getgrav grav-plugin-flex-objects

Default version status: unaffected

  • 1.4.0 to < 1.4.17affected
  • 1.4.17unaffected

References