CVE-2026-62670
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Grav Flex Objects plugin prior to 1.4.3 has requireFlexPermission() that returns without denying access when a directory blueprint omits config.admin.permissions. An authenticated account with only api.access can use index, show, create, update, delete, export, and media handlers for a permission-less directory even though the core admin.flex-object authorization fallback would deny the same actions.
Risk Assessment
Unauthorized users may gain access to object management operations, potentially leading to unauthorized changes, deletions, or data export.
Recommendation
Update the Grav Flex Objects plugin to version 1.4.3 or later and ensure directory blueprints include appropriate permissions.
Other vulnerabilities in Grav Flex Objects Plugin
See all- CVE-2026-114659Medium
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions without enforcing api.pages.read/write or page-level permission rules. Authenticated non-super users can read page source and frontmatter, modify content, or delete pages they are denied.
- CVE-2026-58655High
The Grav Flex Objects plugin before version 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, user-controlled frontmatter values are passed to Twig's template_from_string(), causing them to be evaluated as Twig code rather than text. This bypasses Grav's Security::cleanDangerousTwig() sanitization.
Original NVD description (English source)
Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An authenticated account with only api.access can use the index, show, create, update, delete, export, and media handlers for a permission-less directory even though the core admin.flex-object. authorization fallback would deny the same actions. This issue is fixed in version 1.4.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS