CVE-2026-112779 in Grav Api Plugin
Summary
by MITRE • 10/19/2026
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The Grav API plugin versions prior to 1.0.42 contain two distinct security vulnerabilities that compromise the integrity and availability of systems running the Grav content management system. The first vulnerability is a resource exhaustion flaw located in the unauthenticated GET /api/v1/translations/{lang} endpoint, which allows attackers to trigger excessive memory or disk usage through crafted requests targeting translation handling mechanisms.
This specific issue stems from an improper caching strategy where the plugin stores a complete translation dictionary for every well-formed language code provided by a requester. While intended to improve performance by avoiding repeated database lookups, this implementation lacks any mechanism to limit cache size or evict old entries based on frequency of access or system resource constraints. Consequently, an unauthenticated attacker can send small but distinct requests for various language codes, each causing the system to allocate approximately 560 KB of storage in either disk space or APCu memory. By systematically cycling through different language identifiers, the attacker can rapidly exhaust available server resources, leading to a denial of service condition where legitimate users are unable to access the application due to resource saturation. This behavior aligns with CWE-400, which describes uncontrolled resource consumption, and maps to MITRE ATT&CK technique T1496, representing Resource Hijacking for Denial of Service purposes.
The second vulnerability involves an authorization bypass within the sync and batch copy endpoints that affects accounts possessing api.pages.write permissions. In this scenario, the plugin fails to adequately validate target and destination page rules when processing synchronization or bulk copying operations. This oversight allows authenticated users with write access to manipulate pages in ways that are explicitly prohibited by existing page-level security configurations. Specifically, these attackers can overwrite protected translations or create new pages that violate administrative restrictions designed to control content structure and visibility. This flaw represents a failure in enforcing proper authorization controls at the application logic level rather than just through role-based access checks, corresponding closely with CWE-269, which covers Improper Privilege Management.
The operational impact of these vulnerabilities is significant for both system stability and data integrity. The resource exhaustion vulnerability enables remote unauthenticated attackers to disrupt service availability without needing valid credentials, making it a high-risk vector for denial-of-service attacks against public-facing Grav installations. Meanwhile, the authorization bypass allows compromised or malicious internal users with limited write privileges to escalate their impact by circumventing granular page-level rules, potentially leading to unauthorized content modification and structural integrity issues within the CMS.
To mitigate these risks, administrators must upgrade the grav-plugin-api package to version 1.0.42 or later immediately upon release. This update addresses both the caching logic in the translation endpoint and the validation checks in the sync and batch copy endpoints. Until upgrading is possible, implementing a Web Application Firewall rule to rate-limit requests to the /api/v1/translations/{lang} path can help mitigate the resource exhaustion attack vector by preventing rapid sequential calls from single sources. Additionally, reviewing API access policies to ensure that api.pages.write permissions are granted only to trusted users with minimal necessary privileges can reduce the risk associated with the authorization bypass flaw. Regular monitoring of server memory and disk usage metrics is also recommended to detect potential abuse patterns early in an attack lifecycle.