CVE-2026-56707: Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode

Q: Who can exploit this issue?

A user with page-edit access can exploit it. They can place a Flex Objects shortcode in a published page to render registered Flex collections that they are not authorized to access through the admin panel.

Q: What information could be exposed?

The issue can expose the contents of any registered Flex collection, including sensitive directory contents such as user account information. The provided impact data indicates high confidentiality impact, with no stated integrity or availability impact.

Q: How can I determine whether my site is affected?

Sites using Grav Flex Objects versions 1.4.0 through 1.4.7 are affected. Review published pages created or editable by lower-privileged users for Flex Objects shortcodes that render collections outside the author's intended permissions.

Published Aug 25, 2026

Updated

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to expose sensitive directory contents including user account information, bypassing the authorize ACL enforced in the admin panel.

Affected Software

1 affected component

grav/flex-objects>=1.4.0<=1.4.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Grav Flex Objects to a version that resolves this vulnerability.
Fixed in 1.4.0
Upgrade
Upgrade Grav Flex Objects to a version that resolves this vulnerability.
Fixed in 1.4.7

Event History

Aug 25, 2026

CVE Published

via MITRE·01:30 AM

Data Sourced

via MITRE·01:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with page-edit access can exploit it. They can place a Flex Objects shortcode in a published page to render registered Flex collections that they are not authorized to access through the admin panel.

What information could be exposed?

The issue can expose the contents of any registered Flex collection, including sensitive directory contents such as user account information. The provided impact data indicates high confidentiality impact, with no stated integrity or availability impact.

How can I determine whether my site is affected?

Sites using Grav Flex Objects versions 1.4.0 through 1.4.7 are affected. Review published pages created or editable by lower-privileged users for Flex Objects shortcodes that render collections outside the author's intended permissions.

CVE-2026-56707: Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

How can I determine whether my site is affected?