CVE-2026-112779: Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated resource exhaustion?
Instances running Grav API Plugin 1.0.40 before 1.0.42 are exposed if the unauthenticated GET /api/v1/translations/{lang} endpoint is reachable. An attacker can submit well-formed language codes without credentials, causing roughly 560 KB of translation data to be cached per request and exhausting disk or APCu.
What access is required to bypass page-level rules?
The sync and batch copy issues affect versions 1.0.16 before 1.0.42. Exploitation requires an account with the api.pages.write permission; unauthenticated access is not described for these endpoints.
What can an attacker with api.pages.write do through the permission bypass?
Such an account can overwrite translations or create pages even when target or destination page-level rules would deny those actions. The affected checks are in the sync and batch copy endpoints.
How can I determine whether my instance is affected?
Check the installed Grav API Plugin version. Versions 1.0.40 and 1.0.41 are affected by the translation-cache exhaustion issue, while versions 1.0.16 through 1.0.41 are affected by the page-rule bypass.