CVE-2026-114659 Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114659?
CVE-2026-114659 is a high-severity vulnerability in getgrav grav-plugin-flex-objects, published on 22 Oct 2026.
Official description
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.
Weakness: CWE-424
Which versions are affected by CVE-2026-114659?
How do I fix CVE-2026-114659?
No fix has been published for CVE-2026-114659 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114659 being exploited?
There is no known exploitation of CVE-2026-114659 in the wild and no public exploit code.
Sources
Also known as GHSA-7hqv-ch9q-jw4v.