# CVE-2026-56707: Grav Flex Objects authorization bypass in shortcode

Source: https://junglewise.ai/threats/cve-2026-56707-grav-flex-objects-authorization-bypass-in-shortcode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-56707 · Severity: high · CVSS 7.7 · Published 2026-08-25

The Grav Flex Objects plugin is used to manage and display collections of structured content on Grav-powered websites. A flaw in the flex-objects shortcode allows users with page-editing permissions to expose any registered data collection—including user account lists with usernames, emails, and admin status—to the public by bypassing the access controls normally enforced in the admin panel.

Technologies: [Grav Flex Objects](https://junglewise.ai/threats/technologies/flex-objects). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-56707 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56707 being exploited in the wild.

**How severe is CVE-2026-56707?** High severity, with a CVSS score of 7.7, published 25 August 2026.

**Which products and versions are affected?** Grav Flex Objects 1.4.0 through 1.4.7.

**Is there a fix for CVE-2026-56707?** A patch was published on 2026-08-10: Flex Objects 1.4.8 released with authorization checks Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56707 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56707?** Check whether you run Grav Flex Objects at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check (CWE-862) in the FlexObjectsShortcode::renderCollection() method. The shortcode accepts a collection name from a user-controlled attribute and directly calls Flex::getCollection() without verifying the user's permissions against the target directory's authorize ACL. An attacker with page-edit privileges can inject a [flex-objects collection=<type>] shortcode into a published page to render sensitive Flex directories without authorization, bypassing Twig sandbox restrictions. The shortcode was introduced in version 1.4.0 and affected all 1.4.x releases through 1.4.7. A fix was released in version 1.4.8 that adds authorization checks and requires opt-in configuration before a collection can be rendered publicly.

## Affected products

- Grav Flex Objects 1.4.0 through 1.4.7

## Timeline

- 2026-08-10: disclosed: GitHub security advisory GHSA-x929-528m-vx2m published
- 2026-08-10: patched: Flex Objects 1.4.8 released with authorization checks
- 2026-08-25: advisory: CVE-2026-56707 published

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-x929-528m-vx2m](https://github.com/getgrav/grav/security/advisories/GHSA-x929-528m-vx2m)
- [https://www.vulncheck.com/advisories/grav-flex-objects-through-authorization-bypass-via-shortcode](https://www.vulncheck.com/advisories/grav-flex-objects-through-authorization-bypass-via-shortcode)

## Related threats

- [Grav Flex-Objects broken access control in admin-next REST API](https://junglewise.ai/threats/cve-2026-62235-grav-flex-objects-broken-access-control-in-admin-next-rest-api)
- [Grav Flex Objects server-side template injection in dynamic titles](https://junglewise.ai/threats/cve-2026-58655-grav-flex-objects-server-side-template-injection-in-dynamic)