CVE-2026-72831
Received Received - Intake

Incorrect Authorization in Flex Objects Plugin Allows Privilege Escalation

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72831
EUVD
EUVD-2026-58645

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
getgrav flex_objects to 1.4.7 (exc)
getgrav flex_objects 1.4.7
getgrav grav 2.0.11
getgrav grav to 2.0.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72831 is an authentication bypass vulnerability in the Flex Objects plugin for Grav. It allows an authenticated attacker with limited permissions to escalate privileges and take over a site. The flaw occurs because the plugin's API does not enforce proper authorization checks, letting attackers modify super-admin accounts or grant themselves super-admin access.

Detection Guidance

Check if the Flex Objects plugin version is below 1.4.7. Inspect API logs for suspicious requests to /api/v1/flex-objects/user-accounts or /api/v1/flex-objects/user-groups. Verify if unauthorized password changes or privilege escalations occurred in admin accounts.

Impact Analysis

An attacker could exploit this to change a super-admin's password or grant themselves super-admin privileges. This results in full control of the Grav site, allowing unauthorized access, data theft, or disruption of services. The impact is severe due to the high CVSS scores (8.7-8.8).

Mitigation Strategies

Update the Flex Objects plugin to version 1.4.7 or later. Review and restrict API permissions for users, ensuring only necessary permissions like api.access and users.update are granted. Monitor admin accounts for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72831. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart