# CVE-2026-62235: Grav Flex-Objects broken access control in admin-next REST API

Source: https://junglewise.ai/threats/cve-2026-62235-grav-flex-objects-broken-access-control-in-admin-next-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-62235 · Severity: medium · CVSS 6.3 · Published 2026-07-17

A security flaw in the Grav Flex-Objects plugin allows users with basic API access to perform unauthorized actions on certain data directories. Specifically, if a data directory is not explicitly configured with security permissions, the system 'fails open,' allowing low-privileged users to create, read, update, or delete records they should not be able to see. This could lead to the unauthorized modification or theft of sensitive business data stored within the Grav content management system.

Technologies: [Grav Flex Objects](https://junglewise.ai/threats/technologies/flex-objects). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-62235 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62235 being exploited in the wild.

**How severe is CVE-2026-62235?** Medium severity, with a CVSS score of 6.3, published 17 July 2026.

**Which products and versions are affected?** Grav Flex Objects < 1.4.3.

**Is there a fix for CVE-2026-62235?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-62235 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-62235?** Check whether you run Grav Flex Objects at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A 'fail-open' authorization vulnerability exists in the `requireFlexPermission()` method within `classes/Api/FlexApiController.php`. The method validates permissions against a directory's `admin.permissions` configuration; however, if this configuration block is missing from a directory's blueprint, the method returns void (allowing access) instead of denying it. An authenticated attacker with basic `api.access` permissions can exploit this to perform full CRUD (Create, Read, Update, Delete) and export operations on any Flex directory that lacks an explicit permission map. This bypasses the core Grav framework's default-deny logic. The issue is resolved in version 1.4.3 by implementing an explicit check against core authorization rules when no specific directory permissions are defined.

## Affected products

- getgrav grav-plugin-flex-objects < 1.4.3

## Timeline

- 2026-06-29: advisory: GitHub Security Advisory published by vendor
- 2026-07-17: disclosed: NVD publication date

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-23vq-365v-qcmh](https://github.com/getgrav/grav/security/advisories/GHSA-23vq-365v-qcmh)
- [https://www.vulncheck.com/advisories/grav-flex-objects-authorization-bypass-via-api](https://www.vulncheck.com/advisories/grav-flex-objects-authorization-bypass-via-api)

## Related threats

- [Grav Flex Objects authorization bypass in shortcode](https://junglewise.ai/threats/cve-2026-56707-grav-flex-objects-authorization-bypass-in-shortcode)
- [Grav Flex Objects server-side template injection in dynamic titles](https://junglewise.ai/threats/cve-2026-58655-grav-flex-objects-server-side-template-injection-in-dynamic)