TI-2026-51057 Aliases CVE-2026-72831 GHSA-7cc5-h479-2c5p

Grav through 2.0.11 Authentication Bypass via Flex Objects

HIGH 73CWE-863Published 2026-08-14 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00855 58th percentileScored 2026-11-07

Fix Fixed grav-plugin-flex-objects (trilbymedia): 1.4.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
getgrav	grav	2.0.11 – 2.0.11	—	No fix listed	CNA
Trilby Media	grav-plugin-flex-objects	before 1.4.7	1.4.7	Patch available	CNA

grav Vendorgetgrav Affected 2.0.11 – 2.0.11 Fixed in — No fix listed CNA
grav-plugin-flex-objects VendorTrilby Media Affected before 1.4.7 Fixed in 1.4.7 Patch available CNA

Remediation

Fix · CNA grav-plugin-flex-objects (trilbymedia) Fixed in 1.4.7

Timeline

2026-10-02 Threatist record created from CVE-2026-72831
2026-10-03 Alias added: GHSA-7cc5-h479-2c5p
2026-10-29 Fix available: trilbymedia/[email protected] · CNA
2026-10-30 EPSS moved to the 50th–90th percentile

References

Patch 4

Advisory 1

GitHub Security Advisory (GHSA-pc8m-jxvh-vmrc)

TI-2026-30893 Grav: Privilege Escalation via Missing Server-Side Validation of groups/access CVSS 3.1CRITICAL 9.4
TI-2025-28971 Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
TI-2021-04523 Unauthenticated Arbitrary YAML Write/Update leads to Code Execution CVSS 3.1CRITICAL 9.8
TI-2026-50940 Grav CMS before 2.0.16 Origin Validation Bypass via Referer CVSS 4.0CRITICAL 9.3
TI-2026-46446 Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData CVSS 4.0CRITICAL 9.3
TI-2021-22428 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) CVSS 4.0CRITICAL 9.3

See all 228 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences