CyberRota Analysis
AI-GeneratedThe Grav Flex Objects plugin versions 1.4.0 to 1.4.7 is vulnerable to an authorization bypass, allowing users with page-edit access to exploit the flex-objects shortcode and access any registered Flex collection without proper permission checks. This vulnerability can lead to the exposure of sensitive directory contents, including user account information, potentially compromising user privacy and security. Organizations using this plugin should prioritize patching or upgrading to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to expose sensitive directory contents including user account information, bypassing the authorize ACL enforced in the admin panel.