CVE-2026-114659Medium· 6.5▾ SunlitGrav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.
grav-plugin-flex-objects >= 1.4.0 < 1.4.17Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114658High· 8.8Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite
CVE-2026-114657Medium· 5.7Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri
CVE-2026-114660Medium· 6.3Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives
CVE-2026-112782High· 7.5Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service
CVE-2026-112780High· 8.8Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@
CVE-2026-112779Critical· 9.8Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass