Which versions of Grav Flex Objects are affected by CVE-2026-56707?

The Grav Flex Objects plugin (versions 1.4.0-1.4.7) contains an authorization bypass that exposes sensitive user account data to any content editor, bypassing administrator-only restrictions.. A patch is available.

How to fix or mitigate CVE-2026-56707?

Within 24 hours, inventory all Grav installations running Flex Objects 1.4.0-1.4.7 and audit page-edit permissions to identify users with access. Within 7 days, either disable the Flex Objects plugin entirely if not mission-critical, or restrict page-edit permissions to a minimal set of trusted administrators only; additionally, audit all published pages for shortcode injection. Within 30 days, monitor Grav and Flex Objects vendor advisories for a security patch and prepare an upgrade plan; ensure all future Flex Objects deployments use only patched versions once released.

Grav Flex Objects CVE-2026-56707

Q: What is the CVSS score of CVE-2026-56707?

CVE-2026-56707 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-65205 HIGH

Missing Authorization (CWE-862)

2026-08-25 VulnCheck

GHSA-f549-r4pw-jw3m

Authentication Bypass Grav Getgrav

8.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

PR:L for required page-edit account; S:U as data exposure stays within Grav's security boundary; C:H for full collection read; no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 25, 2026 - 03:16 EUVD

Analysis Generated

Aug 25, 2026 - 02:19 vuln.today

CVE Published

Aug 25, 2026 - 01:30 cve.org

HIGH 8.3

DescriptionCVE.org

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to expose sensitive directory contents including user account information, bypassing the authorize ACL enforced in the admin panel.

AnalysisAI

Authorization bypass in the Grav Flex Objects plugin (versions 1.4.0-1.4.7) allows any user holding page-edit access to render arbitrary registered Flex collections - including the full user account directory - by embedding a shortcode in published pages. The shortcode rendering path entirely omits the authorize ACL checks enforced in the admin panel, meaning lower-privileged editors can extract sensitive data that would otherwise be restricted to administrators. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated account on the target Grav installation with page-edit (content authoring) permission - this is the sole prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, scored 8.3) accurately captures the threat: network-reachable, low complexity, low-privilege exploitation with high confidentiality impact on both the vulnerable system (VC:H - Flex collection contents) and surrounding system scope (SC:H - user account data that administrators expected to be access-controlled). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update the Grav Flex Objects plugin to a version beyond 1.4.7 per the vendor advisory at https://github.com/getgrav/grav/security/advisories/GHSA-x929-528m-vx2m - the exact patched release version was not stated in the available intelligence and must be confirmed at the advisory URL before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.