# CVE-2026-114660: Grav improper access control in FlexDirectory::dynamicFlexField()

Source: https://junglewise.ai/threats/cve-2026-114660-grav-from-2-0-0-before-2-2-5-contains-an-improper-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-114660 · Severity: medium · CVSS 6.3 · Published 2026-10-22

Grav is a flat-file CMS that allows content creation through web-based editing. A page author can craft a malicious page containing Flex form directives that, when opened by a user with higher edit privileges, execute arbitrary methods on the CMS's page objects in that user's session. This allows the attacker to delete protected pages that neither the author nor the targeted user normally has permission to delete.

Technologies: [Grav](https://junglewise.ai/threats/technologies/grav). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-114660 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114660 being exploited in the wild.

**How severe is CVE-2026-114660?** Medium severity, with a CVSS score of 6.3, published 22 October 2026.

**Which products and versions are affected?** Grav 2.0.0 before 2.2.5.

**Is there a fix for CVE-2026-114660?** Yes: fixed in 2.2.5. Until then: Restrict page authoring permissions to trusted users only, and review existing pages for suspicious flex-*@ directives in frontmatter that call methods like setStorageKey() or delete(). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114660 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-114660?** Check whether you run Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.2.5

Restrict page authoring permissions to trusted users only, and review existing pages for suspicious flex-*@ directives in frontmatter that call methods like setStorageKey() or delete().

## Technical details

The FlexDirectory::dynamicFlexField() function processes flex-*@ directives in page frontmatter by calling arbitrary public methods on Flex objects with attacker-controlled arguments, without proper authorization checks. An attacker chains setStorageKey() and delete() method calls to redirect an authorized Flex object to a protected page and delete it. The directives execute only when a user with edit permissions for the named object views the page, running within that user's session and privileges.

## Affected products

- Grav Grav 2.0.0 before 2.2.5

## Timeline

- 2026-10-07: disclosed
- 2026-10-22: advisory

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-95jr-q4xh-27vr](https://github.com/getgrav/grav/security/advisories/GHSA-95jr-q4xh-27vr)
- [https://www.vulncheck.com/advisories/grav-2.0.0-before-2.2.5-unauthorized-page-deletion-via-flex-form-directives](https://www.vulncheck.com/advisories/grav-2.0.0-before-2.2.5-unauthorized-page-deletion-via-flex-form-directives)

## Related threats

- [Grav allowlist bypass in Flex form processing](https://junglewise.ai/threats/cve-2026-116019-grav-2-0-15-before-2-2-13-contains-an-allowlist-bypass)
- [Grav information disclosure via Twig HTTP Basic credentials](https://junglewise.ai/threats/cve-2026-114657-grav-from-2-0-0-before-2-2-5-contains-an-information-disclosure)
- [Grav image pixel limit bypass allows resource exhaustion](https://junglewise.ai/threats/cve-2026-112782-grav-1-7-53-before-1-7-53-5-and-2-0-0-rc-8-before-2-2-2-contains)
- [Grav information disclosure via nested Git repositories](https://junglewise.ai/threats/cve-2026-109326-grav-before-2-1-7-contains-an-information-disclosure)
- [Grav Clockwork profiler authentication bypass in loopback check](https://junglewise.ai/threats/cve-2026-109325-grav-from-2-0-22-before-2-1-7-contains-an-authentication-bypass)