Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-72831

Grav through 2.0.11 Authentication Bypass via Flex Objects

The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Getgrav Trilbymedia
Products
Grav Grav-plugin-flex-objects
CVE-2026-114659

Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Getgrav
Products
Grav-plugin-flex-objects
CVE-2026-62670

Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An authenticated account with only api.access can use the index, show, create, update, delete, export, and media handlers for a permission-less directory even though the core admin.flex-object. authorization fallback would deny the same actions. This issue is fixed in version 1.4.3.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Getgrav
Products
Grav-plugin-flex-objects