High severity7.7NVD Advisory· Published Aug 25, 2026· Updated Aug 31, 2026

CVE-2026-56707

Description

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to expose sensitive directory contents including user account information, bypassing the authorize ACL enforced in the admin panel.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Grav CMS/Flex Objectsllm-fuzzy
Range: 1.4.0 - 1.4.7

Patches

Vulnerability mechanics

References

github.com/getgrav/grav/security/advisories/GHSA-x929-528m-vx2mnvd
www.vulncheck.com/advisories/grav-flex-objects-through-authorization-bypass-via-shortcodenvd

News mentions

Grav CMS: Eight Vulnerabilities Including Path Traversal and Auth Bypass Disclosed Together
Vypr Intelligence · Aug 25, 2026

cvss	0.501
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000