Product
An authorization bypass vulnerability (CVE-2026-56707) in Grav Flex Objects plugin versions 1.4.0 through 1.4.7 allows authenticated users with page-edit privileges to exfiltrate sensitive data by rendering unauthorized Flex collections via shortcodes.