CVE-2026-62670: Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)
Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An authenticated account with only api.access can use the index, show, create, update, delete, export, and media handlers for a permission-less directory even though the core admin.flex-object. authorization fallback would deny the same actions. This issue is fixed in version 1.4.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
grav-plugin-flex-objects admin-next APIto a version that resolves this vulnerability.Fixed in 1.4.3
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
An authenticated account that has only the api.access permission can exploit it. No additional Flex Object-specific permission is required when the targeted directory blueprint omits config.admin.permissions.
Which operations are exposed for an affected directory?
The affected Admin Next API handlers are index, show, create, update, delete, export, and media. This can allow reading, modifying, deleting, exporting, and handling media for the permission-less directory.
Are all Flex Object directories affected?
No. The issue applies to directories whose blueprint omits config.admin.permissions. Directories with configured admin permissions are not described as affected by this fail-open path.
How can I determine whether my deployment is vulnerable?
Deployments using Grav Flex Objects Plugin versions earlier than 1.4.3 are affected if they expose the Admin Next API and have a directory blueprint without config.admin.permissions. Review directory blueprints for that omitted setting and review accounts granted api.access.
What should be done if upgrading cannot happen immediately?
Restrict api.access to fully trusted accounts and avoid leaving config.admin.permissions unset on directory blueprints. Upgrade the Grav Flex Objects Plugin to version 1.4.3 when possible.