CVE-2026-114660
6.3 MEDIUMpublic exploit availablePublished 2026-10-22 · Updated 2026-10-22
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Weaknesses
CWE-470
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2017-20285PoC
- HIGHCVE-2026-100308PoC
- HIGHCVE-2026-101292
- HIGHCVE-2026-102094PoC
- LOWCVE-2026-102580
- HIGHCVE-2026-104629PoC
- MEDIUMCVE-2026-105064
- HIGHCVE-2026-105782PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.