All vulnerabilities
CVE-2026-112779GHSA-8pcm-97fc-4xwh

grav-plugin-api: Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass

getgrav grav-plugin-api
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.0.42Fixed versionCVE List
Published19 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.

Text from CVE List

Affected versions 2

  • grav-plugin-apiaffected: 1.0.16 before 1.0.42CVE List
  • grav-plugin-apiunaffected: 1.0.42CVE List

References 2