CVE-2026-114659
CVE-2026-114659 · Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.
CVSS 7.1 · High · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
grav-plugin-flex-objects
- Versions
- ≥ 1.4.0, < 1.4.17: Affected (semver)
- 1.4.17: Not affected (semver)
Update to 1.4.17