CVE-2026-62670

Name of the Vulnerable Software and Affected Versions Grav Flex Objects Plugin versions prior to 1.4.3

Description An issue exists where the requireFlexPermission() function in classes/Api/FlexApiController.php fails to deny access when a directory blueprint omits config.admin.permissions. This allows an authenticated account with only api.access to bypass the core admin.flex-object. authorization fallback. Consequently, users can utilize the index, show, create, update, delete, export, and media handlers for directories lacking explicit permissions.

Recommendations Update Grav Flex Objects Plugin to version 1.4.3.