Is there a patch available for CVE-2026-62235?

Yes, a patch is available for CVE-2026-62235. Update the affected software to the latest version immediately.

Grav Flex-Objects CVE-2026-62235

Q: What is the CVSS score of CVE-2026-62235?

CVE-2026-62235 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45081 LOW

Missing Authorization (CWE-862)

2026-07-17 VulnCheck

GHSA-gv8p-326f-p8gj

Authentication Bypass Grav Getgrav

2.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.0 MEDIUM

AC:H reflects the AT:P condition (permission-less directories must exist); PR:L reflects mandatory api.access authentication; no scope change applies.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 01:02 vuln.today

DescriptionCVE.org

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any directory lacking an explicit permissions configuration, bypassing intended authorization controls.

AnalysisAI

Broken access control in Grav Flex-Objects before 1.4.3 permits authenticated users holding only the api.access permission to perform full CRUD operations on directories lacking explicit permission configurations via the admin-next REST API. The vulnerability bypasses intended authorization controls (CWE-862) because the REST API fails to enforce object-level permission checks when no explicit policy is defined for a directory. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 4.0 AT:P metric confirms exploitation depends on the target instance containing permission-less directories, which may be common in default or lightly configured deployments.

Technical ContextAI

Grav is a flat-file CMS (CPE: cpe:2.3:a:getgrav:grav) and Flex-Objects is its plugin that provides a flexible object model with a REST API layer (admin-next). The affected endpoint exposes CRUD and export operations governed by a permission matrix; CWE-862 (Missing Authorization) applies because the API does not enforce access controls on directories that lack an explicit permission entry, treating absence-of-policy as implicit allow rather than implicit deny. The attack requirement (CVSS 4.0 AT:P) reflects that the vulnerable code path is only reachable when such permission-less directories exist in the Grav installation.

RemediationAI

Upgrade Grav Flex-Objects to version 1.4.3 or later, which is the vendor-released patch as confirmed by the GitHub security advisory at https://github.com/getgrav/grav/security/advisories/GHSA-23vq-365v-qcmh. If immediate upgrade is not possible, a targeted compensating control is to audit all Flex-Objects directories and assign explicit permission configurations to each, eliminating the permission-less condition that AT:P identifies as the prerequisite. Additionally, restricting api.access grants to only trusted administrative accounts reduces the attacker population. Restricting network access to the admin-next REST API endpoint via firewall or reverse-proxy ACL is also effective, though it may impact legitimate API integrations.