Answer in brief
CVE-2026-72831 records a High severity (CVSS 8.8) vulnerability in Grav through 2.0.11 Authentication Bypass via Flex Objects. The current sources do not mark it as known exploited. The current feed maps getgrav/grav (generic), getgrav/grav (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps getgrav/grav (generic), getgrav/grav (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| getgrav/gravgeneric | 2.0.11 | Not reported |
| getgrav/gravgeneric | >=0 <1.4.7 | 1.4.7 |
Published upstream
Aug 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 14, 2026
The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.
Quoted source text, attributed separately from HOL analysis.