CVE-2026-72831
Description
The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.
How to fix
- trilbymedia grav-plugin-flex-objects1.4.7 or later
- github.com/getgrav/grav/commit/ad9709f865b09b68798fb1ac375b484a8cc1d892
- github.com/trilbymedia/grav-plugin-flex-objects/commit/0b384f5b0e73b1ad9dd29c70185407895ea3b09f
- github.com/getgrav/grav-plugin-api/commit/8071c10bc3a4743a4b8cf003dfb1644d6680c2ea
- github.com/getgrav/grav-plugin-admin2/commit/a0bf26f7e5d7a98894b7cd2b8c5afe419b264e53
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| getgrav grav | 2.0.11 | — |
| trilbymedia grav-plugin-flex-objects | v < 1.4.7 | 1.4.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.