Jalajknimesh

**Name of the Vulnerable Software and Affected Versions** Flex Objects versions 1.0.0 through 1.4.6 **Description** An incorrect authorization issue exists in the Flex Objects API. The `FlexApiController::update()` function only verifies general Flex directory permissions and fails to apply the target, field, and super-admin checks required by the Users and Groups API controllers. An authenticated user with `api.access`, `admin.login`, and `users.update` permissions can exploit this by using the '/api/v1/flex-objects/user-accounts' endpoint to modify a super administrator's password or the '/api/v1/flex-objects/user-groups' endpoint to grant their group `admin.super` privileges, leading to a complete site takeover. **Recommendations** Update to version 1.4.7.