Description (CNA)
Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| getgrav / grav | affected 2.0.0 before 2.2.5; unaffected 2.2.5 |
CWE
CWE-470