A high severity authorization bypass vulnerability in the Grav Flex Objects plugin allows authenticated attackers to perform unauthorized operations, potentially leading to full system compromise.

This vulnerability is caused by an incorrect authorization check (CWE-863) within the Flex Objects plugin. An authenticated user with low privileges can bypass intended access controls to interact with restricted functions.

Successful exploitation of this flaw could allow an attacker to gain unauthorized access to data or administrative functions within the Grav environment. Given the high CVSS score of 8.8, this poses a significant risk to the integrity and confidentiality of the content management system, potentially resulting in unauthorized administrative control.

Immediate Action: Update the Grav installation and the Flex Objects plugin to version 1.4.7 or later to address the authorization flaw.

Proactive Monitoring: Review application access logs for unusual patterns of interaction with the Flex Objects plugin or unauthorized attempts to access administrative endpoints.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter requests targeting the Flex Objects plugin functionality until updates are applied.

Public Exploit Available: No confirmed public exploit (exploit_available: false).

The severity of this vulnerability necessitates immediate attention. Administrators must prioritize updating the Grav core and associated plugins to the specified fixed versions to prevent potential unauthorized administrative access.