VulnSea

grav-plugin-flex-objects vulnerabilities

CVEs whose affected-version data names the grav-plugin-flex-objects package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-114659Medium· 6.5
today

Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/…

▾ Sunlitgetgrav · grav-plugin-flex-objectsvia CVEORG
grav-plugin-flex-objects vulnerabilities (CVEs) · VulnSea