Executive brief
The Grav Flex Objects plugin is used to manage and display collections of structured content on Grav-powered websites. A flaw in the flex-objects shortcode allows users with page-editing permissions to expose any registered data collection—including user account lists with usernames, emails, and admin status—to the public by bypassing the access controls normally enforced in the admin panel.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the FlexObjectsShortcode::renderCollection() method. The shortcode accepts a collection name from a user-controlled attribute and directly calls Flex::getCollection() without verifying the user's permissions against the target directory's authorize ACL. An attacker with page-edit privileges can inject a [flex-objects collection=<type>] shortcode into a published page to render sensitive Flex directories without authorization, bypassing Twig sandbox restrictions. The shortcode was introduced in version 1.4.0 and affected all 1.4.x releases through 1.4.7. A fix was released in version 1.4.8 that adds authorization checks and requires opt-in configuration before a collection can be rendered publicly.
Affected products
- Grav Flex Objects 1.4.0 through 1.4.7
Timeline
- 2026-08-10: disclosed: GitHub security advisory GHSA-x929-528m-vx2m published
- 2026-08-10: patched: Flex Objects 1.4.8 released with authorization checks
- 2026-08-25: advisory: CVE-2026-56707 published