CVE-2026-114659 — Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages pe…
Published: 2026-10-22 · CVSS: 7.1 · CVSS 4.0
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7