Executive brief
A security flaw in the Grav Flex-Objects plugin allows users with basic API access to perform unauthorized actions on certain data directories. Specifically, if a data directory is not explicitly configured with security permissions, the system 'fails open,' allowing low-privileged users to create, read, update, or delete records they should not be able to see. This could lead to the unauthorized modification or theft of sensitive business data stored within the Grav content management system.
Technical details
A 'fail-open' authorization vulnerability exists in the `requireFlexPermission()` method within `classes/Api/FlexApiController.php`. The method validates permissions against a directory's `admin.permissions` configuration; however, if this configuration block is missing from a directory's blueprint, the method returns void (allowing access) instead of denying it. An authenticated attacker with basic `api.access` permissions can exploit this to perform full CRUD (Create, Read, Update, Delete) and export operations on any Flex directory that lacks an explicit permission map. This bypasses the core Grav framework's default-deny logic. The issue is resolved in version 1.4.3 by implementing an explicit check against core authorization rules when no specific directory permissions are defined.
Affected products
- getgrav grav-plugin-flex-objects < 1.4.3
Timeline
- 2026-06-29: advisory: GitHub Security Advisory published by vendor
- 2026-07-17: disclosed: NVD publication date