CVE-2026-56707: Missing Authorization in getgrav grav

CVE-2026-56707 is an authorization bypass vulnerability affecting Grav Flex Objects plugin versions 1.4.0 through 1.4.7. The issue exists in the flex-objects shortcode, which fails to enforce permission checks when rendering registered Flex collections. Users with page-edit privileges can exploit this to display any Flex collection, exposing sensitive data including user account details. This bypasses the intended access control list (ACL) protections in the admin panel, leading to unauthorized data exposure. The CVSS 4.0 score is 8.3 (high severity), reflecting network attack vector, low attack complexity, no privileges required beyond page-edit, no user interaction, and high impact on confidentiality.

The vulnerability allows unauthorized exposure of sensitive directory contents, including user account information, by bypassing the authorization ACL in the admin panel. This can lead to data leakage and compromise of sensitive information accessible through Flex collections. The impact is confidentiality loss without requiring elevated privileges beyond page-edit access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict page-edit access to trusted users only to mitigate risk. Monitor vendor communications for official patches or updates addressing this vulnerability.