Live › vulnerability › CVE-2026-114659
Go to dashboardThe Grav Flex Objects plugin (versions 1.4.0 before 1.4.17) exposes generic /api/v1/flex-objects/pages routes that check only directory-level admin permissions and skip the Pages API's per-page rules. An authenticated user with API access and page admin rights can read page source and frontmatter, change content, or delete pages they should be denied.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Grav with the Flex Objects plugin between 1.4.0 and 1.4.17 that have authenticated users with API access and page-level admin permissions are exposed. Sites with only super-admin users, or without the plugin installed, are not affected by the bypass as described.
No product ranges from the sources yet.
user/plugins/flex-objects directory or blueprint.yaml; affected versions are 1.4.0 up to but not including 1.4.17.api.access together with admin.pages or admin.configuration.pages permissions.1.4.17 or later.api.access and page admin permissions to trusted users only.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.
This page as .md · .json · in your agent: get_signal("CVE-2026-114659")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.