CVE-2026-114659: Improper Protection of Alternate Path in getgrav grav-plugin-flex-objects

CVE-2026-114659 is an authorization bypass vulnerability in the Grav Flex Objects plugin (versions >=1.4.0 <1.4.17). The generic /api/v1/flex-objects/pages API routes improperly enforce permissions by only checking directory-level admin.pages permissions, neglecting the Pages API's api.pages.read/write permissions and page-level permission rules. As a result, authenticated users who are not super administrators but have api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are normally denied access to.

This vulnerability allows unauthorized read, modification, and deletion of page content by authenticated users with limited permissions. It compromises the integrity and confidentiality of page data within the Grav CMS environment, potentially leading to unauthorized content changes or data loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions to trusted users only and monitor access to the affected API routes. Avoid granting api.access and admin.pages or admin.configuration.pages permissions to users who should not have page-level read/write/delete capabilities.