CVE-2026-62235: Grav Flex-Objects < 1.4.3 Authorization Bypass via API

Vulnerability summary

CVE-2026-62235 is a medium (CVSS 6.3) Failing Open vulnerability in getgrav grav. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.1% of scored vulnerabilities.

Timeline

1. 17-07-2026
   PublishedVulnerability first disclosed.
2. 17-07-2026
   Last modifiedVulnerability information updated.

Description

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any directory lacking an explicit permissions configuration, bypassing intended authorization controls.

• CWE-636Not Failing Securely ('Failing Open')When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.