CVE-2026-62235

MediumCVSS 6.3

Published: 17/07/2026(UTC)Updated: 17/07/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

A broken access control vulnerability in Grav Flex-Objects before version 1.4.3 allows authenticated users with api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any directory lacking explicit permissions, bypassing intended authorization controls.

Risk Assessment

The risk involves unauthorized data access and manipulation in directories without permissions, potentially leading to data leakage, modification, or deletion by individuals with basic API credentials.

Recommendation

Immediately update Grav Flex-Objects to version 1.4.3 or later, which includes a fix for the access control vulnerability. Additionally, configure explicit permissions for all directories.

Other vulnerabilities in Grav Flex-Objects

CVE-2026-56707High
Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to expose sensitive directory contents including user account information, bypassing the authorize ACL enforced in the admin panel.

Original NVD description (English source)

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any directory lacking an explicit permissions configuration, bypassing intended authorization controls.