The Flex Objects plugin (through version 1.4.6) for Grav CMS contains an authorization bypass in its Flex Objects API. Specifically, the FlexApiController::update() method only checks general Flex directory permissions and does not enforce additional target/field/super-admin checks that are present in the dedicated Users and Groups API controllers. As a result, an authenticated user with api.access, admin.login, and users.update permissions—but lacking api.users.write or admin.super—can exploit the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password or use the /api/v1/flex-objects/user-groups endpoint to assign the admin.super group. This vulnerability enables full site takeover. The issue is fixed in Flex Objects 1.4.7.

An attacker with authenticated access and specific permissions can escalate privileges to super administrator level, allowing full control over the affected Grav CMS site. This can lead to complete site compromise, including unauthorized administrative actions and potential data breaches.

Upgrade the Flex Objects plugin to version 1.4.7 or later, where this authorization vulnerability is fixed. Until the update is applied, restrict access to users with the affected permissions and monitor for suspicious activity related to the Flex Objects API endpoints. Patch status is confirmed fixed in Flex Objects 1.4.7.