All vulnerabilities
CVE-2026-114660GHSA-95jr-q4xh-27vr

Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives

getgrav grav
Open in ThreatlineRecord JSON
CVSS
7.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.2.5Fixed versionCVE List
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.

Text from CVE List

Affected versions 2

  • gravaffected: 2.0.0 before 2.2.5CVE List
  • gravunaffected: 2.2.5CVE List

References 2