Grav Flex Objects Authorization Bypass (GHSA-pc8m-jxvh-vmrc) Analysis and Fix

Vulnerability Overview Vulnerability Name: Low-privilege users can change the super admin password via Flex Objects Vulnerability ID: GHSA-pc8m-jxvh-vmrc Severity: High Reporter: rhukster Published Date: 3 weeks ago Affected Scope Affected Versions: - Flex Objects (Grav Plugin): 1.4.6 - getgrav/grav (Composer): ≥2.0.11 Patched Versions: - Flex Objects (Grav Plugin): 1.4.7 - getgrav/grav (Composer): None Vulnerability Description Vulnerability Type: Privilege Escalation / Authorization Bypass Details: Low-privilege users can utilize the generic Flex API endpoints to change the super administrator's password or elevate their own privileges to super admin. The standard Users and Groups API endpoints correctly prevent such modifications. Access Requirements The attacker requires a Grav account with specific permissions: The account must not possess , , or permissions. Reproduction Steps 1. Create a super admin account and a low-privilege account with the permissions listed above. 2. Log in as via and copy the bearer token. 3. Send a standard Users API request to modify the password; it is rejected with HTTP 403, and the password remains unchanged. 4. Send the same modification request through the generic Flex endpoint. 5. The request returns HTTP 200, and the super admin's password is successfully changed. 6. Log in as using the new password; the login succeeds, and the response includes . Root Cause only checks generic Flex directory permissions before forwarding the entire request body to the user or group object for saving. It does not execute the additional security checks performed by the dedicated Users and Groups controllers. Relevant Code Correct comparison checks: Correct group checks: Impact Low-privilege accounts can take over existing super admin accounts or elevate themselves to super admin status, thereby gaining complete control over the Grav site. Recommended Severity: High CWE: CWE-863 (Incorrect Authorization) CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — 8.8 Remediation Recommendations Prevent and resources from accessing the generic Flex whitelisted route. Redirect these requests to the dedicated Users and Groups controllers, or apply the same target, field, and super admin checks before saving.

Goal Reached Thanks to every supporter — we hit 100%!

Grav Flex Objects Authorization Bypass (GHSA-pc8m-jxvh-vmrc) Analysis and Fix

More from this source