Grav Flex Objects EUVD-2026-58645

Exploitation requires an existing authenticated Grav account that simultaneously holds the permissions api.access, admin.login, and users.update - but explicitly lacks api.users.write and admin.super. This is the permission profile of a delegated administrator who can manage users through the normal admin UI but has not been granted full super-admin rights; it is a non-default but operationally common configuration in multi-user Grav sites. The attacker must have network-level access to the Grav API endpoints (/api/v1/flex-objects/user-accounts or /api/v1/flex-objects/user-groups). Exploitation is limited by: the requirement for a pre-existing authenticated account (CVSS PR:L confirmed); that account must hold the specific three-permission combination above; and the target site must have at least one super-admin account to target for password replacement, or a group structure that can be escalated. Default single-admin Grav installations with no delegated user accounts cannot be exploited by an unauthenticated attacker.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately captures the core risk: network-reachable, low-complexity exploitation by an authenticated low-privileged account yielding full confidentiality, integrity, and availability impact on the Grav system. Real-world risk is highest in multi-administrator Grav deployments with delegated roles, which is the exact trust model the vulnerability targets. Single-admin installations are not exploitable from unauthenticated positions, providing meaningful natural scoping. This CVE is not listed in CISA KEV and no EPSS score was provided in the intelligence data, indicating no confirmed widespread active exploitation at time of analysis. However, the patch commits are public and the attack path (specific endpoints and permission combination) is fully described, lowering exploit development effort significantly. The gap between the attacker's required permissions (common delegated-admin set) and the impact achieved (super-admin takeover) makes this a genuine priority for sites with non-trivial admin hierarchies, despite the absence of KEV confirmation.

An attacker holding a delegated Grav admin account - one with api.access, admin.login, and users.update but without api.users.write or admin.super - sends a crafted HTTP PATCH request to /api/v1/flex-objects/user-accounts targeting the super administrator's account object with a replacement password field. FlexApiController::update() validates only the broad Flex directory permission, accepts the write, and the super-admin password is overwritten. The attacker then logs in as super administrator, achieving unrestricted control over the site, all content, all users, and server-side configuration. No public exploit code is confirmed at time of analysis, but the commit diffs and full attack path are publicly documented, substantially reducing weaponization effort.