CVE-2026-62235

Grav Flex-Objects < 1.4.3 Authorization Bypass via API

State: Published
Severity: 2.3 Low
Published: Jul 17, 2026
Updated: Jul 17, 2026
Reserved: Jul 13, 2026

Description

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any directory lacking an explicit permissions configuration, bypassing intended authorization controls.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulnCheck
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulnCheck

Weaknesses

CWE-862 Missing Authorization
CWE-636 Not Failing Securely ('Failing Open')

Affected Products

Product	Versions
gravgetgrav	before 1.4.3Affected 1.4.3Not affected

References

GitHub Security Advisory (GHSA-23vq-365v-qcmh)vendor-advisory
VulnCheck Advisory: Grav Flex-Objects < 1.4.3 Authorization Bypass via APIthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.