CVE-2026-114660: Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives
Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Grav installations running version 2.0.0 through versions before 2.2.5 are affected. Exploitation involves a user who can author or edit page content and another user with page edit rights who opens the crafted page.
What does an attacker need to do to exploit it?
An attacker needs page authoring rights to place flex-*@ directives in page frontmatter. They must induce a user with page edit rights to open that page, causing the directives to execute in that user's session.
What is the impact of successful exploitation?
The attacker can cause protected pages to be deleted through calls to setStorageKey() and delete(). The affected accounts do not themselves need permission to delete those protected pages.
How can I determine whether an installation is affected?
Check the installed Grav version. Versions from 2.0.0 up to, but not including, 2.2.5 are affected; review page frontmatter for flex-*@ directives, particularly directives that invoke setStorageKey() or delete().