CVE-2026-114660

Name of the Vulnerable Software and Affected Versions Grav versions 2.0.0 through 2.2.4

Description An improper access control issue exists in the dynamicFlexField() function within FlexDirectory. This allows page authors to execute arbitrary Flex object methods by using flex-*@ directives in the page frontmatter. If a user with page edit permissions opens the affected page, directives that call setStorageKey() and delete() are executed within their session, potentially leading to the deletion of protected pages that neither the author nor the editor should be able to remove.

Recommendations Update Grav to version 2.2.5 or later.