CVE-2026-62670 Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)

🗓️ 19 Aug 2026 15:26:27Reported by GoogleType

osv🔗 osv.dev👁 7 Views

Grav Flex Objects plugin v1.4.2 lacks else-deny in requireFlexPermission, allowing api.access users full CRUD on permission-less directories.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-62235	17 Jul 202600:07	–	attackerkb
CVE	CVE-2026-62235	17 Jul 202600:07	–	cve
Cvelist	CVE-2026-62235 Grav Flex-Objects < 1.4.3 Authorization Bypass via API	17 Jul 202600:07	–	cvelist
EUVD	EUVD-2026-45081	17 Jul 202600:07	–	euvd
NVD	CVE-2026-62235	17 Jul 202602:18	–	nvd
Positive Technologies	PT-2026-60645	17 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-62235 Grav Flex-Objects < 1.4.3 Authorization Bypass via API	17 Jul 202600:07	–	vulnrichment

Source	Link
github	www.github.com/trilbymedia/grav-plugin-flex-objects/releases/tag/1.4.3
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62670.json
github	www.github.com/getgrav/grav/security/advisories/GHSA-23vq-365v-qcmh
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-62670
github	www.github.com/trilbymedia/grav-plugin-flex-objects/commit/198d1a0eb7b94777a026ed0001d9a369d94c3002

21 Aug 2026 03:46Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.16.3

EPSS0.00169