# CVE-2026-114659: Grav Flex Objects plugin authorization bypass in pages API

Source: https://junglewise.ai/threats/cve-2026-114659-grav-flex-objects-plugin-1-4-0-before-1-4-17-contains-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-114659 · Severity: medium · CVSS 6.5 · Published 2026-10-22

Grav's Flex Objects plugin, which manages content pages in a CMS environment, contains an authorization flaw in its API routes. Authenticated users with basic API access and page administration permissions can bypass page-level restrictions to read, modify, or delete pages they should not have access to. This allows unauthorized content exposure and manipulation.

Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-114659 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114659 being exploited in the wild.

**How severe is CVE-2026-114659?** Medium severity, with a CVSS score of 6.5, published 22 October 2026.

**Which products and versions are affected?** Grav Flex Objects plugin 1.4.0 through 1.4.16.

**Is there a fix for CVE-2026-114659?** Yes: fixed in 1.4.17. Until then: Remove admin.pages and admin.configuration.pages permissions from non-super accounts and groups, or restrict api.access from accounts that do not require API functionality, until the plugin can be updated.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-07"},{"kind":"patched","at":"2026-10-22"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114659 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114659?** Check whether you run Grav Flex Objects plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.4.17

Remove admin.pages and admin.configuration.pages permissions from non-super accounts and groups, or restrict api.access from accounts that do not require API functionality, until the plugin can be updated.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-07"},{"kind":"patched","at":"2026-10-22"}]

## Technical details

The Flex Objects plugin's generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions without enforcing the Pages API's api.pages.read/write permissions or page-level permission rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can exploit this to bypass page-level authorization checks via an alternate API path, circumventing restrictions that the primary Pages API correctly enforces.

## Affected products

- Grav Flex Objects plugin 1.4.0 through 1.4.16

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-2pvc-r9gj-mcpf](https://github.com/getgrav/grav/security/advisories/GHSA-2pvc-r9gj-mcpf)
- [https://www.vulncheck.com/advisories/grav-flex-objects-1.4.0-before-1.4.17-authorization-bypass-via-pages-api-routes](https://www.vulncheck.com/advisories/grav-flex-objects-1.4.0-before-1.4.17-authorization-bypass-via-pages-api-routes)