CVE-2026-114659: Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-22 · updated 2026-10-23
Weakness: CWE-424

Description

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.

Affected products

getgrav grav-plugin-flex-objects: from 1.4.0 before 1.4.17 — fixed in 1.4.17

How to fix

Upgrade to a fixed version: getgrav grav-plugin-flex-objects 1.4.17. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-114659 or the next vulnerability affects your stack