CVE-2026-62235: Grav Flex-Objects < 1.4.3 Authorization Bypass via API
Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any directory lacking an explicit permissions configuration, bypassing intended authorization controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav Flex-Objectsto a version that resolves this vulnerability.Fixed in 1.4.3 - Compensating control
If you cannot upgrade immediately, restrict access to the admin-next REST API so that only fully authorized users can use api.access credentials, preventing unauthorized CRUD/export operations on directories lacking explicit permissions configuration.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62235?
The severity of CVE-2026-62235 is medium with a CVSS score of 6.3.
How do I fix CVE-2026-62235?
To fix CVE-2026-62235, upgrade Grav Flex-Objects to version 1.4.3 or later.
What type of vulnerability is CVE-2026-62235?
CVE-2026-62235 is an authorization bypass vulnerability affecting the admin-next REST API.
Who is affected by CVE-2026-62235?
Authenticated users with only api.access permission are affected by CVE-2026-62235.
What can attackers do in CVE-2026-62235?
Attackers with api.access credentials can perform unauthorized CRUD operations on permission-less directories.