The Grav Flex Objects Plugin contains a fail‑open authorization flaw in the Admin‑Next API. The requireFlexPermission() method in FlexApiController.php returns without denying when a directory blueprint omits config.admin.permissions. An authenticated user who has only the api.access role can therefore call the index, show, create, update, delete, export, and media handlers for a permission‑less directory, giving full CRUD capability. This allows the user to add, modify, or delete content that should have been restricted. The weakness is a missing else‑deny check, categorized as CWE‑862.

All installations of the Grav Flex Objects Plugin older than version 1.4.3 are affected. This includes all releases of the getgrav:grav-plugin‑flex‑objects package that precede the 1.4.3 release.

The CVSS score of 6.3 labels this vulnerability as Medium severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires only an authenticated user possessing the api.access role, which is typically granted to developers or front‑end applications. No special network access or additional privileges are required beyond normal API authentication, making the attack vector straightforward. Because the vulnerability allows full CRUD operations, an attacker could alter or delete site content, potentially causing data loss or subsequent security compromise. The risk is therefore moderate to high for sites that expose the API without proper role restrictions.