CVE-2026-114659

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules...

CVE-2026-114659

The Grav Flex Objects plugin (versions 1.4.0 before 1.4.17) is vulnerable to an authorization bypass via its generic /api/v1/flex-objects/pages API routes. The root cause is that these routes only validate directory-level admin.pages permissions while failing to enforce necessary api.pages.read/w...

EUVD-2026-107901

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules...