CVE-2026-72831 in Grav
Summary
by MITRE • 08/14/2026
The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability exists within the Flex Objects plugin version 1.4.6 and earlier, specifically affecting Grav 2.0.11 installations where the Flex Objects API fails to properly enforce authorization checks during object updates. This represents a critical authorization flaw that undermines the security model of the platform by allowing authenticated users with limited permissions to perform privileged actions through the generic Flex Objects API endpoints.
The technical flaw stems from the FlexApiController::update() method implementation which only verifies general directory permissions for the Flex objects rather than enforcing the more granular access controls that should apply to specific target objects, fields, or user roles. This oversight creates a bypass mechanism where users can exploit the lack of proper validation to manipulate sensitive system components through the generic API interface.
The operational impact of this vulnerability is severe as it allows an authenticated attacker with api.access, admin.login, and users.update permissions to escalate privileges without possessing the specific api.users.write or admin.super permissions that should normally be required for such operations. This enables attackers to modify super administrator passwords via the user-accounts endpoint or grant administrative super privileges to their own groups through the user-groups endpoint, effectively achieving complete system compromise.
The vulnerability aligns with CWE-285 (Improper Authorization) and represents a classic privilege escalation attack vector that violates the principle of least privilege. According to ATT&CK framework, this maps to T1078 (Valid Accounts) and T1484 (Domain Policy Modification) as it allows attackers to leverage legitimate credentials to gain elevated privileges. The issue demonstrates poor access control implementation where generic API endpoints fail to enforce role-based access controls that should be specific to the target object being modified.
Security mitigations for this vulnerability include upgrading to Flex Objects version 1.4.7 or later, which implements proper authorization checks across all Flex objects. Organizations should also review their permission assignments to ensure that users with api.access and users.update permissions do not inadvertently gain access to sensitive system functions through the generic API endpoints. Additionally, implementing principle of least privilege configurations and regularly auditing user permissions can help prevent exploitation of such authorization gaps in the system architecture.