{"id":"CVE-2026-114660","kind":"vulnerability","aliases":["CVE-2026-114660"],"related":[],"title":"Grav CMS: page frontmatter lets authors delete protected pages","description":"Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.","summary":"Grav versions from 2.0.0 before 2.2.5 let a user with page edit rights use flex-*@ directives in page frontmatter to call arbitrary Flex object methods. When another user opens the page, those directives run in their session and can delete protected pages.","severity":"high","cvss":7.0,"epss":0.00211,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","grav","php","runtime","self-hosted"],"not_affected_if":["already-on-2.2.5-or-later","single-trusted-editor"],"how_to_check":"- Check the installed Grav version and confirm whether it is below `2.2.5`\n- Review whether untrusted or low-privilege users have page edit rights","fix":"- Upgrade Grav to `2.2.5` or later\n- Review existing page frontmatter for flex-*@ directives that were not written by trusted editors","status":"open","published_at":"2026-10-22T02:16:58+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:37:00+00:00","updated_at":"2026-10-25T03:37:00+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:37:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Grav to `2.2.5` or later\n- Review existing page frontmatter for flex-*@ directives that were not written by trusted editors","reach":"network","title":"Grav CMS: page frontmatter lets authors delete protected pages","impact":"medium","summary":"Grav versions from 2.0.0 before 2.2.5 let a user with page edit rights use flex-*@ directives in page frontmatter to call arbitrary Flex object methods. When another user opens the page, those directives run in their session and can delete protected pages.","category":"runtime","nicknames":[],"who_cares":["grav","php","self-hosted","cms"],"confidence":0.7,"needs_auth":"yes","worst_case":"protected pages get deleted by another editor's session","analyst_note":"Confirm the affected version range and whether the GitHub or NVD advisory lists a patch commit or workaround beyond upgrading to 2.2.5.","how_to_check":"- Check the installed Grav version and confirm whether it is below `2.2.5`\n- Review whether untrusted or low-privilege users have page edit rights","needs_analyst":true,"not_affected_if":["already-on-2.2.5-or-later","single-trusted-editor"],"who_is_affected":"Sites running Grav 2.0.0 through 2.2.x before 2.2.5 where more than one account can edit pages. Single-editor sites that only admins touch carry less exposure, but the fix is the same version bump.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000611,"input_tokens":3402,"output_tokens":542,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114660':12A,15A '-2026':11A,14A '2.0.0':26B,67C '2.2.5':28B,69C 'access':73C 'account':118C 'allow':80C 'anoth':49B 'arbitrari':44B,85C 'author':6A,82C 'call':43B,84C,106C 'cms':2A,16B 'contain':70C 'control':74C 'cve':10A,13A 'delet':7A,62B,109C,114C,120C 'direct':38B,55B,91C,105C 'dynamicflexfield':78C 'edit':34B,100C 'flex':37B,45B,86C,90C 'flexdirectori':77C 'frontmatt':4A,41B,94C 'grav':1A,17B,23B,65C 'host':22B 'improp':72C 'let':5A,29B 'may':119C 'method':47B,88C 'neither':117C 'object':46B,87C 'open':51B,102C 'page':3A,9A,33B,40B,53B,64B,81C,93C,99C,104C,116C 'php':18B 'protect':8A,63B,115C 'right':35B,101C 'run':56B,110C 'runtim':19B 'self':21B 'self-host':20B 'session':59B,113C 'setstoragekey':107C 'use':36B 'user':31B,50B,97C 'version':24B 'via':89C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Sites running Grav 2.0.0 through 2.2.x before 2.2.5 where more than one account can edit pages. Single-editor sites that only admins touch carry less exposure, but the fix is the same version bump.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114660","severity":null,"published_at":"2026-10-22T02:16:58+00:00","modified_at":"2026-10-22T02:16:58+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114660","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114660","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}