EUVD-2026-58645: incorrect authorization in Grav Flex Objects plugin API
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Grav
- Product
- grav-plugin-flex-objects
- First seen
Summary
The EUVD entry, scored 8.7 under CVSS v3.1, describes an incorrect authorization flaw in the Flex Objects plugin API, affecting versions through 1.4.6. The entry says FlexApiController::update() checks only the general Flex permission.
If you use Grav
Update grav-plugin-flex-objects to a version later than 1.4.6
Review Flex Objects API access logs for unexpected update requests
Restrict API permissions until the patch is applied
Upgrade Grav to a release later than 2.0.12
Audit stored content for injected script or event-handler attributes
Enforce a Content Security Policy as a defense in depth
What the sources say 2
· Mastodon: “Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php).” Source
· Mastodon: “The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API.” Source