---
id: CVE-2026-56707
title: >-
  Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization
  bypass vulnerability in the flex-objects shortcode that allows users with
  page-edit access to render any registered Flex collection without permission
  checks.…
summary: >-
  Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization
  bypass vulnerability in the flex-objects shortcode that allows users with
  page-edit access to render any registered Flex collection without permission
  checks.…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-862
published: '2026-08-25'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:10:00.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56707'
references:
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-x929-528m-vx2m'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/grav-flex-objects-through-authorization-bypass-via-shortcode
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00375
epssPercentile: 0.29552
ingestedAt: '2026-10-12T15:55:08.145Z'
---

## Overview

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to expose sensitive directory contents including user account information, bypassing the authorize ACL enforced in the admin panel.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.