CVE-2026-72831

Name of the Vulnerable Software and Affected Versions Flex Objects versions 1.0.0 through 1.4.6

Description An incorrect authorization issue exists in the Flex Objects API. The FlexApiController::update() function only verifies general Flex directory permissions and fails to apply the target, field, and super-admin checks required by the Users and Groups API controllers. An authenticated user with api.access, admin.login, and users.update permissions can exploit this by using the '/api/v1/flex-objects/user-accounts' endpoint to modify a super administrator's password or the '/api/v1/flex-objects/user-groups' endpoint to grant their group admin.super privileges, leading to a complete site takeover.

Recommendations Update to version 1.4.7.