CVE-2026-112779 Details
Description
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.
A vulnerability in the Grav API plugin (grav-plugin-api) versions 1.0.16 prior to 1.0.42 and 1.0.40 prior to 1.0.42 has been identified. The issue arises in the unauthenticated GET /api/v1/translations/{lang} endpoint, where the plugin caches a full translation dictionary for every well-formed language code received. This caching behavior can lead to excessive disk or APCu cache usage, as each request stores approximately 560 KB of data. Additionally, in versions 1.0.16 prior to 1.0.42, the plugin fails to properly enforce page-level rules in the synchronization and batch copy endpoints. As a result, accounts with the api.pages.write permission can overwrite translations or create pages that are restricted by existing page-level rules.
Users can upgrade to Grav API plugin version 1.0.42 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-8pcm-97fc-4xwh | [email protected] | AdvisoryRemedyVendor |
| https://www.vulncheck.com/advisories/grav-api-plugin-before-1.0.42-cache-exhaustion-and-page-permission-bypass | [email protected] | AdvisoryBroken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav API | >= 1.0.16, < 1.0.42 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |