CVE-2026-56707

Grav Flex Objects plugin (versions 1.4.0 through 1.4.7 ) contains an authorization bypass in the flex-objects shortcode. Any user with page-edit access can embed the shortcode in a published page to render any registered Flex collection without the permission checks enforced in the admin panel's ...

CVE-2026-56707 Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

PT-2026-81134

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

CVE-2026-56707: Missing Authorization

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

CVE-2026-62670

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An...

EUVD-2026-62537

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An...

CVE-2026-62670 Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An...

CVE-2026-62670 Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An...

CVE-2026-62670

CVE-2026-62670 is a fail-open authorization flaw in the Grav Flex Objects Plugin (by Trilby Media) prior to version 1.4.3 . The requireFlexPermission() method in classes/Api/FlexApiController.php (Admin Next API) returns without denying access when a directory blueprint omits config.admin.permiss...

CVE-2026-62670: Missing Authorization

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An...

ANT-2026-ZJXVWQEA · flex · Heap Buffer Overflow

heap-buffer-overflow low Severity Claude low · Security research firm low · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-ZJXVWQEA: Heap buffer overflow in sfinit due to stale...

Megaco flex scanner buffer overflow via oversized property parm name

...

PT-2026-72489

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Time-of-Check to Time-of-Use TOCTOU issue exists in the ASOC SOF ipc3-control component. In the sof ipc3 bytes put function, the memcpy operation uses a size derived from the existing...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection in the settings validation process of the Flex Objects plugin via uploading a ZIP archive containing PHP code. An...

Duplicate Advisory: Remote code execution via .zip file upload in Grav CMS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r94f-hx44-8jqf. This link is maintained to preserve external references. Original Description Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation...

CVE-2026-72831

The Flex Objects plugin through 1.4.6, tested with Grav 2.0.11 contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the...

CVE-2026-72819

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72831

The CVE concerns the Grav Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11). The vulnerability resides in FlexApiController::update(), which only enforces general Flex directory permissions and omits the stricter checks enforced by Users and Groups APIs (target/field/super-admin). An a...

CVE-2026-72831

The Flex Objects plugin through 1.4.6, tested with Grav 2.0.11 contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the...

CVE-2026-72831 Grav through 2.0.11 Authentication Bypass via Flex Objects

The Flex Objects plugin through 1.4.6, tested with Grav 2.0.11 contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the...