Improper Authorization in Grav Flex Objects Plugin

The Flex Objects plugin for Grav CMS (versions 1.4.6 and earlier) contains an incorrect authorization vulnerability in its API controller. The FlexApiController::update() method fails to enforce sufficient target-specific or field-level permissions, relying instead on broad directory-level checks. This oversight allows an attacker with existing, low-level administrative access (specifically 'api.access', 'admin.login', and 'users.update' permissions) to interact with the '/api/v1/flex-objects/user-accounts' and '/api/v1/flex-objects/user-groups' endpoints. By manipulating these endpoints, an authenticated adversary can reset the password of a super-administrator account or assign the 'admin.super' permission to their own user group. This flaw leads to complete site takeover. The vulnerability is addressed in Flex Objects version 1.4.7.

Impact

Successful exploitation results in full administrative site takeover, allowing the attacker to modify site content, configure malicious plugins, access sensitive user data, and execute arbitrary server-side code if the environment permits. This affects any Grav CMS instance running the vulnerable Flex Objects plugin, particularly those where multiple administrative users with varying permission levels exist.

Recommendation

• Immediately update the Flex Objects plugin to version 1.4.7 or higher.
• Audit logs for suspicious activity targeting the '/api/v1/flex-objects/user-accounts' and '/api/v1/flex-objects/user-groups' endpoints, specifically looking for password changes or group membership modifications originating from non-super-admin accounts.
• Review current user roles and ensure that the 'users.update' permission is only granted to trusted, fully authorized administrative personnel.