Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114659— Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes

Quick assessment

Affected
getgrav grav-plugin-flex-objects
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Grav Flex Objects 插件在 1.4.0 至 1.4.17 版本之间存在授权绕过漏洞。其通用 API 路由 仅检查目录级别的 权限，未强制执行 Pages API 的 权限或页面级别的权限规则。因此，已认证的非超级用户若拥有 以及 或 权限，即可读取页面源码和 frontmatter、修改内容，或删除本应被禁止访问的页面。

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114659

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes
Source: CVE Program / CVE List V5
Vulnerability Description
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对候选路径的不恰当保护
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
getgrav grav-plugin-flex-objects 1.4.0 ~ 1.4.17 -

II. Public POCs for CVE-2026-114659

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114659

请登录查看更多情报信息。

Other References for CVE-2026-114659 (2)

Same Patch Batch · getgrav · 2026-10-22 · 4 CVEs total

CVE-2026-114658 8.8 HIGH Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite
CVE-2026-114660 6.3 MEDIUM Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives
CVE-2026-114657 5.7 MEDIUM Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri

IV. Related Vulnerabilities

Same product: grav-plugin-flex-objects
Same vendor: getgrav
Same weakness: CWE-424

V. Comments for CVE-2026-114659

No comments yet

Leave a comment