CVE-2026-114659

Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes

State: Published
Severity: 7.1 High
Published: Oct 22, 2026
Updated: Oct 23, 2026
Reserved: Oct 21, 2026

Description

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-424 Improper Protection of Alternate Path

Affected Products

Product	Versions
grav-plugin-flex-objectsgetgrav	1.4.0 to before 1.4.17Affected 1.4.17Not affected

References

GitHub Security Advisory (GHSA-2pvc-r9gj-mcpf)vendor-advisory
VulnCheck Advisory: Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routesthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.