Description
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getgrav | grav-plugin-flex-objects | 1.4.0 – < 1.4.17 | 1.4.17 |
References
- GitHub Security Advisory (GHSA-2pvc-r9gj-mcpf) vendor-advisory
- VulnCheck Advisory: Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes third-party-advisory