CyberRota Analysis
AI-GeneratedGrav Flex-Objects versions prior to 1.4.3 are susceptible to a broken access control vulnerability in the admin-next REST API, enabling authenticated users with only api.access permission to execute unauthorized CRUD operations on directories without explicit permission settings. This flaw allows attackers to manipulate objects freely, potentially compromising sensitive data and system integrity. Organizations utilizing Grav Flex-Objects should prioritize remediation to mitigate the risk of unauthorized access and data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any directory lacking an explicit permissions configuration, bypassing intended authorization controls.