The Flex Objects plugin for Grav 2.0.11 contains an incorrect authorization check in its FlexApiController::update() method. The API allows an authenticated user who has api.access, admin.login, and users.update permissions (but no api.users.write or admin.super) to target the generic /api/v1/flex-objects/user-accounts or /api/v1/flex-objects/user-groups endpoints. Using these endpoints, the attacker can change a super administrator's password or grant their own group admin.super privileges, effectively acquiring full control of the site. This vulnerability is a classic Missing Authorization flaw (CWE-863).

The affected systems are websites running Grav CMS version 2.0.11 with the Flex Objects plugin version 1.4.6 or earlier. The vulnerability was fixed in Flex Objects 1.4.7, so any install that has updated to that version or later is no longer vulnerable. Other Grav versions are not stated as affected, but the same plugin version applies.

The CVSS score of 8.7 indicates High severity, and the lack of an EPSS score does not provide a current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an already authenticated account with particular API permissions, so an attacker who can log in or gain credentials within the site can immediately exercise the exploit via HTTP requests to the affected API endpoints. Because the attack vector is authenticated API access, sites that expose the Flex Objects API to the public or have users with unnecessary permissions represent a high risk of full site takeover.