CVE-2026-62670

The Grav Flex Objects plugin prior to 1.4.3 has requireFlexPermission() that returns without denying access when a directory blueprint omits config.admin.permissions. An authenticated account with only api.access can use index, show, create, update, delete, export, and media handlers for a permission-less directory even though the core admin.flex-object authorization fallback would deny the same actions.

Unauthorized users may gain access to object management operations, potentially leading to unauthorized changes, deletions, or data export.

Update the Grav Flex Objects plugin to version 1.4.3 or later and ensure directory blueprints include appropriate permissions.