Improper Access Control in Grav by RocketTheme
CVE-2026-114660

7HIGH

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114660?

Grav versions prior to 2.2.5 have an improper access control vulnerability within the FlexDirectory::dynamicFlexField() method. This flaw enables users with page editing rights to execute arbitrary Flex object methods through flex-*@ directives in the page frontmatter, such as setStorageKey() and delete(). Consequently, this vulnerability can lead to the unauthorized deletion of protected pages during the user's session, posing a significant risk to content integrity and security.

Affected Version(s)

grav 2.0.0 < 2.2.5

grav 2.2.5

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/grav-2.0.0-before-2....
third-party-advisory

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ffasterss
shirabe0x05
.