High severity · published Aug 25, 2026
CVE-2026-56707
Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode
7.7
CVSS
0.4%
EPSS
No
On KEV
Description
Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to expose sensitive directory contents including user account information, bypassing the authorize ACL enforced in the admin panel.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav · getgrav
before 1.4.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56707
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56707
github.com
https://github.com/getgrav/grav/security/advisories/GHSA-x929-528m-vx2m
www.vulncheck.com
https://www.vulncheck.com/advisories/grav-flex-objects-through-authorization-bypass-via-shortcode
More from grav
9.9
CVE-2024-34082
Grav is a file-based Web platform
9.8
CVE-2026-80203
Grav before 1.0.18 Authentication Bypass via Scoped API Key
9.8
CVE-2026-56710
Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock
9.8
CVE-2026-65008
Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
9.8
CVE-2021-47812
GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)