EUVD-2026-65205
GHSA-f549-r4pw-jw3m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with valid page-edit account
-
DeliveryEmbed flex-objects shortcode referencing target collection
-
ExploitPublish or preview page to trigger render
-
ExecutionShortcode handler bypasses admin ACL check
-
PersistSensitive Flex collection data returned in page response
-
ImpactHarvest user account information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account on the target Grav installation with page-edit (content authoring) permission - this is the sole prerequisite. Admin-level access is not needed. The Flex Objects plugin must be installed and active in versions 1.4.0-1.4.7. At least one sensitive Flex collection (such as the built-in |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, scored 8.3) accurately captures the threat: network-reachable, low complexity, low-privilege exploitation with high confidentiality impact on both the vulnerable system (VC:H - Flex collection contents) and surrounding system scope (SC:H - user account data that administrators expected to be access-controlled). The PR:L rating is the single meaningful barrier: a valid account with page-edit permission is required. In single-author or fully-trusted-editor deployments this is not a practical risk; in community platforms, course systems, or agencies running multi-tenant Grav sites, it is a genuine priority. No EPSS data was included in the intelligence provided. No KEV listing and no confirmed public POC exist, so real-world exploitation remains unconfirmed at time of analysis. The attack requires no technical sophistication once the attacker has the required account, so the operational risk is higher than the credential requirement might suggest. |
| Exploit ScenarioDerived | An attacker with a contributor-level Grav account embeds a |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Authorization bypass in the Grav Flex Objects plugin (versions 1.4.0-1.4.7) allows any user holding page-edit access to render arbitrary registered Flex collections - including the full user account directory - by embedding a shortcode in published pages. The shortcode rendering path entirely omits the authorize ACL checks enforced in the admin panel, meaning lower-privileged editors can extract sensitive data that would otherwise be restricted to administrators. No public exploit or CISA KEV listing exists at time of analysis, but the low privilege bar and network accessibility make this a credible insider or compromised-account threat on multi-author Grav installations.
RemediationAI
Update the Grav Flex Objects plugin to a version beyond 1.4.7 per the vendor advisory at https://github.com/getgrav/grav/security/advisories/GHSA-x929-528m-vx2m - the exact patched release version was not stated in the available intelligence and must be confirmed at the advisory URL before upgrading. If an immediate patch cannot be applied, restrict page-edit permissions to fully trusted administrators only, eliminating the low-privilege attack surface at the cost of limiting collaborative authoring. As an additional compensating control, audit all published pages for existing flex-objects shortcode usage to detect prior exploitation attempts; removing unauthorized shortcodes prevents continued data exposure without requiring a permission change. Disabling the Flex Objects plugin entirely is a viable interim workaround if Flex-based content features are not in active use, though this will break any Flex-powered content or admin UX that depends on the plugin.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Grav is a flat-file PHP CMS; its Flex Objects subsystem provides a structured data-abstraction layer for managing content collections such as users, pages, and custom data types. Shortcodes are template macros registered by plugins that are evaluated during page rendering. CWE-862 (Missing Authorization) is the root cause: the flex-objects shortcode handler in plugin versions 1.4.0-1.4.7 calls into the Flex collection rendering pipeline without first consulting the authorize ACL directive that the admin panel enforces. This creates a privileged rendering path reachable by any account that can save and publish page content. The CPE string cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* identifies the broader getgrav vendor ecosystem; the specifically vulnerable component is the Flex Objects plugin distributed with or alongside Grav, not the Grav core itself.
Know when Grav gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
PR:L for required page-edit account; S:U as data exposure stays within Grav's security boundary; C:H for full collection read; no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to expose sensitive directory contents including user account information, bypassing the authorize ACL enforced in the admin panel.
Executive ViewAI
The Grav Flex Objects plugin (versions 1.4.0-1.4.7) contains an authorization bypass that exposes sensitive user account data to any content editor, bypassing administrator-only restrictions. On multi-author CMS installations, compromised or malicious editors can extract the full user directory through embedded shortcodes, creating an insider-threat and data-exfiltration risk for organizations managing customer or employee identities.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict page-edit permissions to trusted administrators only, (2) audit and sanitize all published pages for malicious shortcodes, (3) monitor access logs for unusual reads of the user collection, (4) consider disabling Flex Objects entirely if not required for core operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Server-side template injection (SSTI) in Grav (getgrav/grav) prior to 1.8.0-beta.27 allows an authenticated attacker hol
Broken access control in Grav CMS (CWE-285) before 1.8.0-beta.27 lets an authenticated editor-level user escalate their
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to wri
Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users perm
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past
Server-side request forgery (SSRF) in Grav CMS versions prior to 1.7.49.5 allows remote authenticated attackers to make
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary
Exploit-DB