---
id: "CVE-2026-114659"
kind: "vulnerability"
aliases: ["CVE-2026-114659"]
title: "Grav Flex Objects plugin lets low-privilege users bypass page permissions"
severity: "high"
cvss: 7.1
epss: 0.00252
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cms", "grav", "package", "self-hosted"]
not_affected_if: ["no-api-access-users", "plugin-1.4.17-or-later", "plugin-not-installed"]
published_at: "2026-10-22T02:16:57+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:31:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114659", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114659", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Grav Flex Objects plugin lets low-privilege users bypass page permissions

The Grav Flex Objects plugin (versions 1.4.0 before 1.4.17) exposes generic /api/v1/flex-objects/pages routes that check only directory-level admin permissions and skip the Pages API's per-page rules. An authenticated user with API access and page admin rights can read page source and frontmatter, change content, or delete pages they should be denied.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Flex Objects plugin in the Grav `user/plugins/flex-objects` directory or `blueprint.yaml`; affected versions are 1.4.0 up to but not including 1.4.17.
- Review which admin users hold `api.access` together with `admin.pages` or `admin.configuration.pages` permissions.

## Fix

- Upgrade the Grav Flex Objects plugin to `1.4.17` or later.
- Until upgraded, restrict `api.access` and page admin permissions to trusted users only.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114659
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114659

## From the sources

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_