Grav Flex Objects API Authorization Bypass Flaw

The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Flex Objects plugin for Grav CMS (versions through 1.4.6) contains a critical authorization bypass vulnerability in its API layer. The FlexApiController::update() method fails to enforce granular permission checks that are properly implemented in dedicated API controllers, allowing authenticated users with basic API and admin permissions to bypass security restrictions. This vulnerability affects Grav installations using the Flex Objects plugin with users holding api.access, admin.login, and users.update permissions but lacking api.users.write or admin.super privileges. Attackers with such mid-level accounts can escalate their capabilities by manipulating API requests that should be restricted to higher-privileged roles, potentially modifying sensitive data or configurations they shouldn't access.

Casky's 283 matching security skills leverage Claude's extended reasoning to identify this authorization bypass pattern across the MITRE ATT&ACK framework, particularly under TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would see detection patterns focused on: (1) API requests to /api/v1 endpoints from accounts with partial-but-not-complete admin permissions, (2) anomalous API call patterns where users invoke Flex Objects updates without corresponding super-admin or api.users.write flags in their permission logs, and (3) discrepancies between permission enforcement in generic API handlers versus specialized controllers like UsersApiController. The platform would flag sequences where authenticated sessions attempt to modify objects or configurations beyond their declared permission scope, surfacing these privilege escalation attempts for investigation before they result in unauthorized access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-72831.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-72831

Casky has 283 skills that investigate the attack patterns behind CVE-2026-72831. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn