Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| getgrav | grav-plugin-flex-objects | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 22 Oct 2026 02:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied. | |
| Title | Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes | |
| Weaknesses | CWE-424 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-22T01:43:44.133Z
Reserved: 2026-10-21T21:59:05.256Z
Link: CVE-2026-114659
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-22T02:16:57.923
Modified: 2026-10-22T02:16:57.923
Link: CVE-2026-114659
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-22T07:15:14Z
-
CWE-424
Improper Protection of Alternate Path