Grav Plugin Flex Objects
Monthly
Authorization bypass in the Grav Flex Objects Plugin prior to version 1.4.3 permits an authenticated user holding only the api.access permission to invoke all admin API handlers - index, show, create, update, delete, export, and media - against any Flex Objects directory whose blueprint omits the config.admin.permissions field. The root cause is a logic inversion in requireFlexPermission() inside FlexApiController.php: when no blueprint permissions are defined, the original code iterated over an empty set and silently returned without throwing a ForbiddenException, bypassing the core admin.flex-object authorization fallback that would otherwise deny the same actions. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available as version 1.4.3.
Authorization bypass in the Grav Flex Objects Plugin prior to version 1.4.3 permits an authenticated user holding only the api.access permission to invoke all admin API handlers - index, show, create, update, delete, export, and media - against any Flex Objects directory whose blueprint omits the config.admin.permissions field. The root cause is a logic inversion in requireFlexPermission() inside FlexApiController.php: when no blueprint permissions are defined, the original code iterated over an empty set and silently returned without throwing a ForbiddenException, bypassing the core admin.flex-object authorization fallback that would otherwise deny the same actions. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available as version 1.4.3.