CVE-2026-72831: Grav through 2.0.11 Authentication Bypass via Flex Objects
The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flex Objectsto a version that resolves this vulnerability.Fixed in 1.4.7 - Compensating control
Restrict access to the Flex Objects API endpoints /api/v1/flex-objects/user-accounts and /api/v1/flex-objects/user-groups so that accounts granted only api.access, admin.login, and users.update cannot reach them.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72831?
CVE-2026-72831 has a high severity rating of 8.8.
How do I fix CVE-2026-72831?
To fix CVE-2026-72831, update the Grav Flex Objects plugin to the latest version that includes the security patches.
What does CVE-2026-72831 affect?
CVE-2026-72831 affects the Grav Flex Objects plugin through version 1.4.6 when used with Grav 2.0.11.
What type of vulnerability is CVE-2026-72831?
CVE-2026-72831 is an authentication bypass vulnerability in the Flex Objects API.
What can attackers achieve with CVE-2026-72831?
Attackers can exploit CVE-2026-72831 to bypass authorization checks and potentially gain unauthorized access to sensitive data.