CVE-2026-114660
Last modified
CVE-2026-114660 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete..
Description
Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-114660?
How severe is CVE-2026-114660?
How do I fix CVE-2026-114660?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-114655libmongocrypt builds requests to external key management ser…5.9
- CVE-2026-114656Traefik before 2.11.58 and 3.7.13 contains an authentication…7.5
- CVE-2026-114657Grav from 2.0.0 before 2.2.5 contains an information disclos…5.7
- CVE-2026-114658Grav Login plugin from 3.6.0 before 3.9.13 contains a missin…8.8
- CVE-2026-114659Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an aut…6.5
- CVE-2026-11466A weakness has been identified in zilliztech deep-searcher u…5.4
- CVE-2026-114661OpenRemote 1.2.0 before 1.31.0 contains a missing authorizat…8.5
- CVE-2026-114662Obot before 0.26.0 contains an authentication bypass vulnera…8.1
- CVE-2026-114663Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constan…8.4
- CVE-2026-114664Frappe Framework before 16.33.0 contains a blind SQL injecti…7.1
- CVE-2026-114665Goploy 1.18.0 before 1.18.1 contains a link following vulner…6.5
- CVE-2026-11467A security vulnerability has been detected in jishenghua jsh…5.4
Are you affected by CVE-2026-114660?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST