Flex Objects Plugin CVE-2026-62670

Exploitation requires two concurrent conditions, both confirmed by the CVE description and CVSS vector PR:L. First, the attacker must hold an authenticated Grav account with at minimum the api.access permission - fully unauthenticated exploitation is not possible. Second, the targeted Flex Objects directory must use a blueprint that omits the config.admin.permissions configuration block; directories with explicitly defined blueprint permissions follow the normal permission-checking branch and are not affected by this bypass regardless of the attacker's privilege level. What limits exploitation further: Grav installations that enforce strict admin account provisioning policies have a materially smaller exposure surface, since api.access must be deliberately granted. Conversely, organizations that allow semi-trusted users to hold api.access, or that use Flex Objects for custom directory types developed without permissions blocks in their blueprints, face the highest real-world risk from this flaw.

The CVSS 3.1 score of 6.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L accurately reflects the attack surface: network-reachable and low complexity, but gated behind a valid authenticated session with at minimum the api.access permission. The C:L/I:L/A:L impact trio is appropriate given that only Flex Objects directories with missing blueprint permissions are exposed - not the entire CMS dataset. EPSS data was not included in the available intelligence, so exploitation probability cannot be quantified numerically; however, the absence of a CISA KEV listing and no identified public proof-of-concept beyond the fix commit suggests this has not seen broad opportunistic exploitation. Despite the moderate CVSS, the low bar to exploitation once an api.access account exists - and the breadth of API actions exposed (create, update, delete, export) - makes this meaningful for any Grav deployment using the plugin, and even a mid-sized municipal IT team in walbrzych managing Grav-based public content sites should treat upgrading to 1.4.3 as an urgent maintenance item rather than a routine patch cycle task. No conflicting signals are present: CVSS, description, and code diff are all consistent in characterizing this as a network-accessible, low-privilege, low-complexity authorization bypass.

An attacker who holds a Grav account with the api.access permission - for example, a low-privilege content editor or an account obtained through credential theft - sends authenticated HTTP API requests targeting a Flex Objects directory type whose blueprint omits config.admin.permissions. Because requireFlexPermission() returns without a denial under this condition, the attacker can enumerate all objects (index), read sensitive records (show), create, modify, or delete data (create/update/delete), and extract files via the media and export handlers - all without possessing any of the specific flex-object permissions that the admin UI would normally enforce. No exploitation tooling beyond standard HTTP requests is required once a qualifying account is available.