CVE-2026-72831

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-72831

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72831.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-72831

Aliases

GHSA-pc8m-jxvh-vmrc

Published

2026-08-14T11:35:37Z

Modified

2026-10-28T02:30:47Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Grav through 2.0.11 Authentication Bypass via Flex Objects

Details

The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72831.json"
}

References

Affected packages

Git / github.com/getgrav/grav

Affected ranges

Type

GIT

Repo

https://github.com/getgrav/grav

Events

Introduced

Fixed

24edf15e167a601f25f3655e723bc174ede09942

Fixed

ad9709f865b09b68798fb1ac375b484a8cc1d892

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.4.7"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "ad9709f865b09b68798fb1ac375b484a8cc1d892"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Type

GIT

Repo

https://github.com/getgrav/grav-plugin-admin2

Events

Introduced

406aa5be18aa4aec01c12cf24a62ab5bc2d88c54

Fixed

a0bf26f7e5d7a98894b7cd2b8c5afe419b264e53

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.0.11"
                },
                {
                    "last_affected":  "2.0.11"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "a0bf26f7e5d7a98894b7cd2b8c5afe419b264e53"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Type

GIT

Repo

https://github.com/getgrav/grav-plugin-api

Events

Introduced

Fixed

8071c10bc3a4743a4b8cf003dfb1644d6680c2ea

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "8071c10bc3a4743a4b8cf003dfb1644d6680c2ea"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Type

GIT

Repo

https://github.com/trilbymedia/grav-plugin-flex-objects

Events

Introduced

Fixed

0b384f5b0e73b1ad9dd29c70185407895ea3b09f

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "0b384f5b0e73b1ad9dd29c70185407895ea3b09f"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*

0.8.0

0.9.0

0.9.10

0.9.11

0.9.12

0.9.13

0.9.14

0.9.15

0.9.16

0.9.17

0.9.18

0.9.19

0.9.2

0.9.3

0.9.4

0.9.5

0.9.6

0.9.7

0.9.8

0.9.9

1.*

1.0.0

1.0.0-beta.1

1.0.0-beta.10

1.0.0-beta.11

1.0.0-beta.12

1.0.0-beta.13

1.0.0-beta.14

1.0.0-beta.15

1.0.0-beta.16

1.0.0-beta.17

1.0.0-beta.2

1.0.0-beta.3

1.0.0-beta.4

1.0.0-beta.5

1.0.0-beta.6

1.0.0-beta.7

1.0.0-beta.8

1.0.0-beta.9

1.0.0-rc.1

1.0.0-rc.10

1.0.0-rc.11

1.0.0-rc.12

1.0.0-rc.13

1.0.0-rc.14

1.0.0-rc.15

1.0.0-rc.16

1.0.0-rc.2

1.0.0-rc.3

1.0.0-rc.4

1.0.0-rc.5

1.0.0-rc.6

1.0.0-rc.7

1.0.0-rc.8

1.0.0-rc.9

1.0.1

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

1.0.15

1.0.16

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1.0

1.1.0-beta.1

1.1.0-beta.2

1.1.0-beta.3

1.1.0-beta.4

1.1.0-beta.5

1.1.0-rc.1

1.1.0-rc.2

1.1.0-rc.3

1.1.1

1.1.17

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.1.9-rc.1

1.1.9-rc.2

1.1.9-rc.3

1.2.0

1.2.0-rc.1

1.2.0-rc.2

1.2.0-rc.3

1.2.1

1.2.2

1.2.3

1.2.4

1.3.0

1.3.0-rc.1

1.3.0-rc.3

1.3.0-rc.4

1.3.0-rc.5

1.3.1

1.3.10

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.5.0-beta.1

1.5.0-beta.2

1.5.0-rc.1

1.6.0-beta.1

1.6.0-beta.2

1.6.0-beta.5

1.6.0-beta.6

1.6.0-beta.7

1.6.0-beta.8

1.6.0-rc.1

1.6.0-rc.2

1.6.0-rc.3

1.6.0-rc.4

1.7.0

1.7.0-beta.1

1.7.0-beta.10

1.7.0-beta.2

1.7.0-beta.3

1.7.0-beta.4

1.7.0-beta.5

1.7.0-beta.6

1.7.0-beta.7

1.7.0-beta.8

1.7.0-beta.9

1.7.0-rc.1

1.7.0-rc.10

1.7.0-rc.12

1.7.0-rc.13

1.7.0-rc.14

1.7.0-rc.15

1.7.0-rc.17

1.7.0-rc.18

1.7.0-rc.19

1.7.0-rc.2

1.7.0-rc.20

1.7.0-rc.3

1.7.0-rc.4

1.7.0-rc.5

1.7.0-rc.6

1.7.0-rc.7

1.7.0-rc.8

1.7.0-rc.9

1.7.1

1.7.10

1.7.12

1.7.13

1.7.14

1.7.15

1.7.16

1.7.17

1.7.18

1.7.19

1.7.20

1.7.21

1.7.22

1.7.23

1.7.24

1.7.25

1.7.26

1.7.26.1

1.7.27

1.7.27.1

1.7.28

1.7.29

1.7.29.1

1.7.3

1.7.30

1.7.31

1.7.32

1.7.33

1.7.34

1.7.35

1.7.36

1.7.37

1.7.37.1

1.7.38

1.7.39

1.7.39.1

1.7.4

1.7.5

1.7.51

1.7.52

1.7.53

1.7.6

1.7.7

1.7.8

1.7.9

2.*

2.0.1

2.0.10

2.0.11

2.0.12

2.0.13

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72831.json"