CVE-2026-62235CWE-636CWE-862

Grav Flex-Objects < 1.4.3 Authorization Bypass via API

Low · published July 17, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
20.1
In the wild
Unconfirmed
What it is

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any directory lacking an explicit permissions configuration, bypassing intended authorization controls.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00287 · 20.1th percentile
Weaknesses
CWE-636 · Not Failing Securely ('Failing Open'); CWE-862 · Missing Authorization
Published
2026-07-17T00:07Z
EPSS history
Timeline
  • 17 JUL 00:07Z
    Grav Flex-Objects < 1.4.3 Authorization Bypass via API
    cvelistv5