CVE-2026-112779 is a critical-rated flaw in the Grav API plugin (grav-plugin-api). Unauthenticated attackers can use it to exhaust disk or APCu storage. Accounts holding api.pages.write can use it to get around page-level permission rules.
What Is It
CVE-2026-112779 covers two problems in the Grav API plugin. VulnCheck published it on 2026-10-19:
- Cache exhaustion (1.0.40 before 1.0.42): The unauthenticated
GET /api/v1/translations/{lang}endpoint caches a full translation dictionary for every well-formed language code it receives. Each small request stores about 560 KB, so an attacker can exhaust disk or APCu storage. - Permission bypass (1.0.16 before 1.0.42): The sync and batch copy endpoints don't check rules on the target and destination pages. Accounts with
api.pages.writecan overwrite translations or create pages that page-level rules are meant to block.
The weakness is classified as CWE-770 (Allocation of Resources Without Limits or Throttling).
Why It Matters
VulnCheck rates the CVE CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and CVSS 4.0 9.3 (Critical). That single vector doesn't match either flaw as the advisory describes them. It pairs no required privileges (PR:N) with high confidentiality and integrity impact. The unauthenticated cache-exhaustion path affects availability only. The integrity impact comes from the permission bypass, which requires an authenticated account with api.pages.write. Defenders should judge the two issues separately and not rely on the combined score alone.
The cache-exhaustion path needs no authentication, no user interaction and little effort, because each small request triggers a large server-side allocation. On exposed Grav sites running the API plugin, this could exhaust storage and degrade or disrupt service. No exploitation of this behavior has been reported in the available data.
The second issue weakens access controls for authenticated API users. Users with write permissions can change content that page-level rules are supposed to protect.
Exploitation status: The supplied data shows no CISA KEV entry for this CVE, so active exploitation is not confirmed. NVD lists the record as "Deferred."
What's Vulnerable
- Vendor: getgrav
- Product: grav-plugin-api
- Affected: versions 1.0.16 up to, but not including, 1.0.42
- The translation cache exhaustion affects 1.0.40 through 1.0.41
- The sync/batch copy permission bypass affects 1.0.16 through 1.0.41
- Unaffected: 1.0.42
NVD lists no affected CPEs.
Patch Status
Version 1.0.42 of grav-plugin-api is listed as unaffected. If you run versions 1.0.16 through 1.0.41, upgrade to 1.0.42 and review which accounts hold the api.pages.write permission. Because the CVE is not in the KEV catalog, there is no CISA KEV required action or due date.