Grav Plugin Flex Objects
Approved changes feed: RSS · Atom
cpe:2.3:a:trilbymedia:grav-plugin-flex-objects:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Trilbymedia (af7dfe6b-d087-547e-8816-4596115f74ff) |
|---|---|
| Product | Grav Plugin Flex Objects (5fc9468b-b27f-58d3-b34a-0459491806dc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-72831 |
vulnerable | 2026-11-03 10:16:26.368179 |
Grav through 2.0.11 Authentication Bypass via Flex Objects
HIGH (8.8)
The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.
Published: 2026-08-14T11:35:37.801Z
Updated: 2026-10-29T21:16:51.350Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.