Dashboard / CVE-2026-72831

CVE-2026-72831

HIGH
MEDIUM Priority: 0.05 BB Relevance: 68/100
Published: 2026-08-14 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: High
VA: High

Description

The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
getgrav grav 2.0.11
getgrav grav 2.0.11
trilbymedia grav-plugin-flex-objects 0 < 1.4.7
trilbymedia grav-plugin-flex-objects 0 < 1.4.7

References & Advisories (6)

Bug Bounty Relevance

68 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.7 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.56%
Raw Score 0.005640
Percentile 46.8%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links