CVE-2026-114659: Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav Flex Objectsto a version that resolves this vulnerability.Fixed in 1.4.17
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
Authenticated non-super users need api.access plus either admin.pages or admin.configuration.pages permission. The issue affects users who are denied access by the Pages API's api.pages.read/write permissions or page-level permission rules but still hold those broader directory-level permissions.
What access could an attacker gain through the affected routes?
An eligible user can read page source and frontmatter, modify page content, or delete pages that they should not be permitted to access.
Which versions are affected?
Grav Flex Objects plugin versions from 1.4.0 up to, but not including, 1.4.17 are affected.