Critical severity · published Oct 19, 2026
CVE-2026-112779
Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav-plugin-api · getgrav
1.0.16 before 1.0.42 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-112779
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-112779
github.com
https://github.com/getgrav/grav/security/advisories/GHSA-8pcm-97fc-4xwh
www.vulncheck.com
https://www.vulncheck.com/advisories/grav-api-plugin-before-1.0.42-cache-exhaustion-and-page-permission-bypass
More from grav-plugin-api
9.4
CVE-2026-62668
Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols
8.8
CVE-2026-62666
Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super
8.8
CVE-2026-72833
Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys
8.8
CVE-2026-42843
grav-plugin-api: Grav API Privilege Escalation to Super Admin
8.7
CVE-2026-86196
Grav API Plugin before 1.0.20 Authentication Bypass via Host Header