CVE-2026-114659: Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes
getgrav · grav-plugin-flex-objects
Fixed in 1.4.17 · Affected: getgrav grav-plugin-flex-objects before 1.4.17 · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 50% of scored CVEs
DescriptionCVE.org
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- getgrav · grav-plugin-flex-objectsfrom 1.4.0 before 1.4.17
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- getgrav
- Published
- October 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-114659 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.