Description

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An authenticated account with only api.access can use the index, show, create, update, delete, export, and media handlers for a permission-less directory even though the core admin.flex-object. authorization fallback would deny the same actions. This issue is fixed in version 1.4.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-19T16:18:19.600Z",
  "pubdate": "2026-08-19T16:18:19.600Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the Grav Flex Objects Plugin prior to version 1.4.3. The flaw resides in the Grav Flex Objects Admin Next API requireFlexPermission() method within classes/Api/FlexApiController.php, where improper access control handling fails to deny access when a directory blueprint omits the config.admin.permissions configuration.\nThis vulnerability allows an authenticated attacker possessing only api.access privileges to successfully invoke index, show, create, update, delete, export, and media handlers against permission-less directories. Consequently, unauthorized users can bypass the intended core admin.flex-object. authorization fallback mechanisms.\nThe risk implication involves unauthorized data manipulation and administrative actions performed against restricted flex objects by low-privileged users. Successful exploitation requires authentication with minimal API access and targets instances running vulnerable plugin versions prior to 1.4.3.",
  "technicalDetails": "The vulnerability stems from improper logic enforcement within the requireFlexPermission() method located in classes/Api/FlexApiController.php of the Grav Flex Objects Plugin. Specifically, when a directory blueprint is configured without explicit config.admin.permissions parameters, the permission validation routine prematurely returns without properly denying access to the requested resource.\nThe affected component is the API controller managing administrative operations for flex objects. Under normal operational security expectations, requests lacking explicit directory-level permissions should default to the core admin.flex-object. authorization fallback, which would restrict unauthorized actions. Due to this flaw, the fallback mechanism is bypassed entirely.\nThe attack flow proceeds as follows: an authenticated user holding restricted privileges limited strictly to api.access crafts an API request targeting a permission-less directory. The request is processed by the FlexApiController, where requireFlexPermission() evaluates the directory blueprint. Because the configuration omits admin permissions, the method exits without enforcing denial, erroneously granting authorization.\nArmed with this bypass, the attacker can leverage multiple exposed handlers including index, show, create, update, delete, export, and media. This permits unauthorized retrieval, creation, modification, and destruction of flex objects. The vulnerability requires existing authentication with api.access capabilities but circumvents the higher-level administrative restrictions intended by the application architecture."
}