CVE-2026-72831
highThe Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API.
The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/getgrav/grav-plugin-admin2/commit/a0bf26f7e5d7a98894b7cd2b8c5afe419b264... disclosure@vulncheck.com
- https://github.com/getgrav/grav-plugin-api/commit/8071c10bc3a4743a4b8cf003dfb1644d6680c2ea disclosure@vulncheck.com
- https://github.com/getgrav/grav/commit/ad9709f865b09b68798fb1ac375b484a8cc1d892 disclosure@vulncheck.com
- https://github.com/getgrav/grav/security/advisories/GHSA-pc8m-jxvh-vmrc disclosure@vulncheck.com
- https://github.com/trilbymedia/grav-plugin-flex-objects/commit/0b384f5b0e73b1ad9dd29c70185... disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/grav-through-authentication-bypass-via-flex-objects disclosure@vulncheck.com
- https://github.com/getgrav/grav/security/advisories/GHSA-pc8m-jxvh-vmrc 134c704f-9b21-4f2e-91b3-4a467353bcc0