CVE-2026-114659 getgrav CVE debrief

Who should care

Defenders responsible for Grav installations, particularly those using Flex Objects plugin 1.4.0 before 1.4.17, should assess exposure and take remediation steps to prevent unauthorized access.

Why it matters

The CVE-2026-114659 vulnerability in Grav Flex Objects plugin 1.4.0 before 1.4.17 allows authenticated non-super users to bypass authorization, potentially leading to unauthorized page access, modification, or data exposure. Defenders should verify and update plugin versions, review user permissions, and monitor API usage to prevent exploitation.

• Potential unauthorized page access and modification
• Possible data exposure or loss
• Required verification of user permissions and API usage
• Necessity to update to patched version 1.4.17

Technical summary

The Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass vulnerability in its /api/v1/flex-objects/pages API routes. This allows authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions to read page source and frontmatter, modify content, or delete pages they are denied access to. The vulnerability is caused by insufficient permission checks in the API routes, allowing unauthorized access to page data and functionality. Defenders should prioritize verifying and updating Grav Flex Objects plugin versions to 1.4.17 or later, reviewing user permissions, and monitoring API usage to prevent exploitation.

Defensive priority

Defenders should prioritize verifying and updating Grav Flex Objects plugin versions to 1.4.17 or later, reviewing user permissions, and monitoring API usage.

Recommended defensive actions

• Verify and update Grav Flex Objects plugin to version 1.4.17 or later
• Review and restrict user permissions to prevent unauthorized access
• Monitor API usage for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the authorization bypass vulnerability in Grav Flex Objects plugin 1.4.0 before 1.4.17. The vendor has released a patched version (1.4.17) to address this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.