PT-2026-60645 · Getgrav · Grav

Cyberkareem · CVE-2026-62235 · Publicado 2026-07-17 · Atualizado 2026-07-17

Mitre

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any directory lacking an explicit permissions configuration, bypassing intended authorization controls.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

CWE-636

Identificadores relacionados

CVE-2026-62235

Produtos afetados

Grav

Referências · 3

• https://github.com/getgrav/grav/security/advisories/GHSA-23vq-365v-qcmh · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-62235 · Nota de Segurança
• https://vulncheck.com/advisories/grav-flex-objects-authorization-bypass-via-api · Nota