What is GHSA-gv8p-326f-p8gj?

GHSA-gv8p-326f-p8gj is a security advisory published by GitHub Security Advisories with Low severity. Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the...

Which CVE IDs does GHSA-gv8p-326f-p8gj cover?

GHSA-gv8p-326f-p8gj covers the following CVE IDs: CVE-2026-62235. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gv8p-326f-p8gj?

GHSA-gv8p-326f-p8gj has a CVSS v3 base score of 6.3, published by GitHub Security Advisories.

GHSA-gv8p-326f-p8gjLowCVSS 6.3

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the...

Vendor

GitHub Security Advisories

Published

July 17, 2026

Last Modified

July 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-62235 →

📋 Description

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any directory lacking an explicit permissions configuration, bypassing intended authorization controls.

🔗 References (4)

https://github.com/getgrav/grav/security/advisories/GHSA-23vq-365v-qcmh
https://nvd.nist.gov/vuln/detail/CVE-2026-62235
https://www.vulncheck.com/advisories/grav-flex-objects-authorization-bypass-via-api
https://github.com/advisories/GHSA-gv8p-326f-p8gj