Grav API CVE-2026-112779: Unauthenticated users drain storage, authenticated ones bypass rules pre-1.0.42
Unauthenticated users can drain server storage via translation caching, while authenticated accounts can bypass security rules in affected versions.
Key points
- CVE-2026-112779 affects Grav API plugin versions prior to 1.0.42.
- Unauthenticated attackers can exhaust disk or APCu with small requests.
- Authenticated users with api.pages.write can bypass page-level restrictions.
Attackers exploiting the Grav API plugin can drain server storage or bypass security rules without needing administrative privileges. The National Vulnerability Database rates this flaw as critical with a CVSS score of 9.3. The vulnerability exists in versions of the getgrav grav-plugin-api before 1.0.42. Security teams should assess their exposure immediately, as the attack surface includes both unauthenticated endpoints and authenticated workflows that fail to enforce existing page-level restrictions.
In plain English
The plugin mishandles two distinct operations, creating separate paths for abuse. First, the system caches translation data for any language code sent to a public endpoint. Each request stores roughly 560 KB of data. An attacker does not need a login to send these requests. By sending many small requests, they can fill the server’s disk or memory cache, causing service disruption for legitimate users.
The background
A second issue affects how the plugin handles page synchronization and batch copying. In versions from 1.0.16 up to 1.0.42, the code fails to verify target and destination page rules during these operations. Any account holding the api.pages.write permission can exploit this oversight. According to the NVD record, such accounts can overwrite existing translations or create new pages that should be denied by page-level security rules.
What changes now
The vendor has released version 1.0.42 to address these weaknesses. This update fixes the translation caching behavior in versions 1.0.40 and later. It also restores proper rule checking for sync and batch copy functions in versions 1.0.16 and newer. Administrators running any version prior to 1.0.42 are exposed to these risks. Updating to the latest release is the confirmed method to mitigate both the disk exhaustion vector and the rule bypass issue.
What made it possible
Teams usually encounter these issues when applications cache external input without size limits or validation. This incident highlights the risk of trusting unauthenticated data in storage-heavy operations. In intrusion stages, such flaws often serve as initial access vectors for denial-of-service or as privilege escalation paths when combined with weak authentication controls. Check whether your systems validate input sizes and enforce access rules consistently across all API endpoints to prevent similar exposure.
What to do and how to stay safe: Grav
- Verify the installed version of the Grav API plugin against the affected range.
- Monitor disk usage and APCu memory for unusual spikes indicating cache exhaustion.
- Review logs for unauthorized page creation or translation overwrites by API users.
- Apply the vendor update once available to close the unauthenticated and authenticated vectors.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the Grav API plugin are vulnerable?
All versions of getgrav grav-plugin-api before 1.0.42 are affected by CVE-2026-112779.
Do attackers need a login to exhaust disk space?
No, the translation caching flaw allows unauthenticated attackers to store data via small requests.
What permissions are needed to bypass page rules?
An account with the api.pages.write permission can exploit the sync and batch copy flaws.
