CVE-2026-62235

The record

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any directory lacking an explicit permissions configuration, bypassing intended authorization controls.

Affected packages

Related vulnerabilities

• CVE-2026-95860 node-opcua is an OPC UA implementation for TypeScript and Node.js. CWE-636
• CVE-2026-109593 An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier… CWE-636
• CVE-2026-110985 A Kafka broker using SASL/OAUTHBEARER with the default validator… CWE-636
• CVE-2026-108142 A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP… CWE-636
• CVE-2026-105933 Apache Pulsar allows an administrator to require end-to-end message encryption for all… CWE-636
• CVE-2026-74048 Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. CWE-636
• CVE-2026-88831 BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed… CWE-636
• CVE-2026-81379 Not failing securely ('failing open') in Visual Studio Code allows an unauthorized… CWE-636