CVE-2026-62670CWE-862broken-access-control

CVE-2026-62670

Medium · published August 19, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An authenticated account with only api.access can use the index, show, create, update, delete, export, and media handlers for a permission-less directory even though the core admin.flex-object. authorization fallback would deny the same actions. This issue is fixed in version 1.4.3.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00332 · 25.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-19T20:18Z
References (3)
https://github.com/getgrav/grav/security/advisories/GHSA-23vq-365v-qcmh · [email protected]https://github.com/trilbymedia/grav-plugin-flex-objects/commit/198d1a0eb7b94777a026ed0001d9a369d94c3002 · [email protected]https://github.com/trilbymedia/grav-plugin-flex-objects/releases/tag/1.4.3 · [email protected]
EPSS history
Timeline
  • 19 AUG 15:26Z
    Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)
    cvelistv5