CVE-2026-114660 in Grav
Summary
by MITRE • 10/23/2026
Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified within Grav CMS versions prior to 2.2.5 represents a critical failure in access control mechanisms embedded within the FlexDirectory component's dynamicFlexField method. This flaw allows authenticated users with page editing privileges to execute arbitrary methods on Flex objects through specially crafted directives in page frontmatter, specifically utilizing flex-*@ syntax. The core technical issue stems from insufficient validation of user permissions when processing these dynamic field definitions, effectively bypassing intended security boundaries and granting elevated capabilities that exceed the scope of standard page authorship rights.
From a technical perspective, the exploitation vector relies on the ability to inject specific directives into the frontmatter metadata of any editable page. When such a page is opened or processed by an administrator or another user with edit permissions, the system interprets these directives as legitimate commands for Flex object manipulation rather than static data fields. This misinterpretation leads to the execution of sensitive methods including setStorageKey and delete on underlying objects that are not intended to be modified through standard content editing workflows. The lack of strict type checking or permission verification during this parsing phase creates a direct path for privilege escalation within the application context.
The operational impact of this vulnerability is severe, particularly regarding data integrity and availability. Attackers can leverage this flaw to delete protected pages that are otherwise inaccessible to regular editors or even certain administrative roles depending on configuration. By forcing the execution of deletion commands through the frontmatter interface, an attacker with minimal privileges can permanently remove critical content from the system without triggering standard audit logs or permission checks associated with direct page management actions. This undermines the fundamental principle of least privilege and compromises the reliability of the content management infrastructure.
In terms of industry classification standards, this vulnerability aligns closely with CWE-269 Improper Privilege Management, as it allows a lower-privileged user to perform actions reserved for higher-privileged roles or system processes. Additionally, the technique of manipulating input fields to execute unintended backend operations corresponds to ATT&CK tactics involving Command and Scripting Interpreter abuse, specifically through indirect command execution via application-specific syntax extensions. The vulnerability also exhibits characteristics of CWE-918 Server-Side Request Forgery if the flex objects interact with external resources during their method calls, though the primary concern remains unauthorized state modification within the local system.
Mitigation strategies must focus on immediate patching and rigorous input validation. Administrators should upgrade Grav CMS to version 2.2.5 or later where these access control checks have been hardened in the FlexDirectory component. Until an update is applied, it is advisable to restrict page editing permissions to only those users who absolutely require them, thereby reducing the attack surface for potential exploitation. Furthermore implementing strict allowlists for acceptable frontmatter keys and disabling dynamic method invocation from user-supplied content can provide a defensive layer against similar injection-based attacks in other components of the application stack.