Quick answers
- Is CVE-2026-62235 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-62235 being exploited in the wild.
- How severe is CVE-2026-62235?
- Medium severity, with a CVSS score of 6.3, published 17 July 2026.
- Which products and versions are affected?
- Grav Flex Objects < 1.4.3.
- Is there a fix for CVE-2026-62235?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-62235 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-62235?
- Check whether you run Grav Flex Objects at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A 'fail-open' authorization vulnerability exists in the `requireFlexPermission()` method within `classes/Api/FlexApiController.php`. The method validates permissions against a directory's `admin.permissions` configuration; however, if this configuration block is missing from a directory's blueprint, the method returns void (allowing access) instead of denying it. An authenticated attacker with basic `api.access` permissions can exploit this to perform full CRUD (Create, Read, Update, Delete) and export operations on any Flex directory that lacks an explicit permission map. This bypasses the core Grav framework's default-deny logic. The issue is resolved in version 1.4.3 by implementing an explicit check against core authorization rules when no specific directory permissions are defined.
Affected products
- getgrav grav-plugin-flex-objects < 1.4.3
Timeline
- 2026-06-29: advisory: GitHub Security Advisory published by vendor
- 2026-07-17: disclosed: NVD publication date