All vulnerabilities
CVE-2026-114659GHSA-2pvc-r9gj-mcpf

grav-plugin-flex-objects: Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes

getgrav grav-plugin-flex-objects
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.4.17Fixed versionCVE List
Published22 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.

Text from CVE List

Affected versions 2

  • grav-plugin-flex-objectsaffected: 1.4.0 before 1.4.17CVE List
  • grav-plugin-flex-objectsunaffected: 1.4.17CVE List

References 2