Description

The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T12:16:46.400Z",
  "pubdate": "2026-08-14T12:16:46.400Z",
  "executiveSummary": "An incorrect authorization vulnerability exists in the Flex Objects plugin through version 1.4.6, tested with Grav 2.0.11, within the Flex Objects API.\nThe vulnerability allows an authenticated attacker to bypass granular access controls and perform unauthorized modifications to user accounts and user groups.\nImpact includes privilege escalation, modification of super administrator passwords, and unauthorized assignment of administrative privileges, ultimately leading to full site takeover.\nThe affected system is the Flex Objects plugin for Grav running through version 1.4.6.\nRisk implications are severe due to the potential for complete compromise of the underlying application and administrative control plane.\nAttacker capabilities require an authenticated account possessing specific base permissions, namely api.access, admin.login, and users.update, but lacking higher-level privileges such as api.users.write or admin.super.\nExploitation requirements rely on leveraging the generic API endpoint to perform actions that are normally restricted by dedicated controller checks.",
  "technicalDetails": "The root cause of the vulnerability resides in the FlexApiController::update() method within the Flex Objects API component.\nDuring execution, FlexApiController::update() validates only the general Flex directory permission.\nIt fails to enforce the additional target, field, and super-admin validation checks that are explicitly required and enforced by the dedicated Users and Groups API controllers.\nThe vulnerable components include the Flex Objects API and specifically the FlexApiController::update() function handling requests to the generic /api/v1/flex-objects/user-accounts and /api/v1/flex-objects/user-groups endpoints.\nAffected versions comprise the Flex Objects plugin through version 1.4.6, as tested with Grav 2.0.11.\nAuthentication requirements dictate that the attacker must possess an authenticated account.\nPrivilege requirements specify that the account must hold api.access, admin.login, and users.update permissions, while operating without api.users.write or admin.super permissions.\nNetwork exposure involves accessibility through the application's REST API endpoints.\nThe attack flow proceeds as follows: First, the authenticated user with limited administrative permissions targets the generic /api/v1/flex-objects/user-accounts or /api/v1/flex-objects/user-groups endpoints.\nSecond, the user initiates an update request via FlexApiController::update(), which bypasses the missing granular security checks.\nThird, the attacker can either directly change a super administrator's password via the user-accounts endpoint or assign the admin.super privilege to their own user group via the user-groups endpoint.\nPost-exploitation impact results in full site takeover, granting the attacker complete administrative control over the application environment."
}