Authorization Flaw in Flex Objects Plugin for Grav

CVE-2026-72831

What is CVE-2026-72831?

The Flex Objects plugin for Grav contains an authorization flaw that allows authenticated users with specific permissions to alter sensitive configurations. Specifically, the FlexApiController::update() method only verifies access to the general Flex directory but overlooks critical checks that the dedicated Users and Groups API controllers enforce. This oversight enables a user with api.access, admin.login, and users.update capabilities to exploit the /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password or manipulate group permissions through the /api/v1/flex-objects/user-groups endpoint, leading to a potential full site compromise. This issue was addressed in Flex Objects version 1.4.7.

References