CyberRota Analysis
AI-GeneratedThe Grav Flex Objects Plugin prior to version 1.4.3 contains a vulnerability that allows authenticated users with minimal permissions (api.access) to perform unauthorized actions on directories lacking specific permission configurations. This could lead to unauthorized access to sensitive data or manipulation of object collections. Organizations using this plugin should prioritize upgrading to version 1.4.3 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An authenticated account with only api.access can use the index, show, create, update, delete, export, and media handlers for a permission-less directory even though the core admin.flex-object. authorization fallback would deny the same actions. This issue is fixed in version 1.4.3.