Authorization Bypass in Grav Flex Objects Plugin by Grav

CVE-2026-114659

What is CVE-2026-114659?

The Grav Flex Objects plugin versions prior to 1.4.17 are susceptible to an authorization bypass vulnerability within its API routes. This vulnerability arises because the API only checks directory-level permissions, neglecting the necessary page-level permissions that should govern access to sensitive operations on pages. Authenticated users who possess limited permissions can exploit this flaw to access, modify, or delete content that they are otherwise restricted from managing, potentially leading to unauthorized exposure of page data.

References