CVE-2026-114659 Details
Description
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.
An authorization bypass vulnerability has been identified in the Grav Flex Objects plugin versions 1.4.0 prior to 1.4.17. The vulnerability arises because the generic API routes for Flex objects pages only verify directory-level admin.pages permissions. They fail to enforce the specific Pages API permissions or page-level permission rules. This oversight allows authenticated non-super users with certain permissions to read, modify, or delete pages they should not have access to.
Users can update to Grav Flex Objects version 1.4.17 or later, where this vulnerability has been fixed. If an immediate update is not possible, non-super accounts should have the admin.pages and admin.configuration.pages permissions removed, or the api.access permission revoked from accounts that do not require it.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-424 | Improper Protection of Alternate Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav Flex Objects | >= 1.4.0, < 1.4.17 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |