CVE-2026-114659

Name of the Vulnerable Software and Affected Versions Grav Flex Objects versions 1.4.0 through 1.4.16

Description An authorization bypass exists in the generic '/api/v1/flex-objects/pages' API endpoint. The issue occurs because the system only verifies directory-level admin.pages permissions and fails to enforce page-level permission rules or the Pages API's api.pages.read/write permissions. Consequently, authenticated non-super users possessing api.access and either admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages for which they lack authorization.

Recommendations Update Grav Flex Objects to version 1.4.17.