CVE-2026-114659
CVE-2026-114659 · Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.
CVSS 7.1 · Alta · EPSS 0,6% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
grav-plugin-flex-objects
- Versiones
- ≥ 1.4.0, < 1.4.17: Afectada (semver)
- 1.4.17: No afectada (semver)
Actualiza a 1.4.17