Grav Flex-Objects CVE-2026-62235

Exploitation requires two simultaneous conditions: (1) the attacker must possess valid credentials with at minimum the api.access permission - unauthenticated exploitation is not possible (PR:L in CVSS 4.0); and (2) the target Grav installation must contain one or more Flex-Objects directories that lack an explicit permissions configuration (the AT:P attack requirement). Sites where every directory has an explicitly defined permission policy are not vulnerable regardless of the attacker's credential level. The attack is further limited to the impact boundary of those permission-less directories - objects in properly permissioned directories remain protected. There is no platform-specific restriction; any OS running a vulnerable Flex-Objects version is affected if both conditions are met.

The CVSS 4.0 base score of 2.3 (Low) reflects a narrow-impact, conditionally exploitable flaw. The AT:P metric is the critical constraint: exploitation requires permission-less directories to exist, meaning sites with fully enumerated permission policies are not vulnerable. PR:L confirms that authentication with api.access credentials is mandatory, which is a significant barrier. Confidentiality, integrity, and availability impacts are all rated Low (VC:L/VI:L/VA:L), consistent with a bounded data-access bypass rather than full system compromise. There is no KEV listing and no known POC, so exploitation risk at time of analysis is theoretical. The primary real-world concern is data exfiltration or manipulation of CMS objects by a low-privilege API user who should not have broad object access. EPSS data is not provided; given the low CVSS score and niche product footprint, opportunistic mass exploitation is unlikely.

An attacker who has obtained valid api.access credentials - for example, through credential reuse, a compromised API token, or a low-privilege account provisioned for integration purposes - sends crafted REST API requests to the admin-next endpoint targeting directories that have no explicit permission policy defined. Because no authorization check is enforced for those directories, the attacker can enumerate, read, create, update, delete, or export Flex-Objects content they are not intended to access. No public exploit code has been identified at time of analysis.