Key points
- CVE-2026-112779 affects Grav API plugin versions before 1.0.42.
- Unauthenticated users can exhaust disk or APCu memory via translation caching.
- Accounts with write permissions can bypass destination page rules during sync.
Security teams managing Grav sites must address vulnerabilities in the API plugin. The Grav API plugin (grav-plugin-api) versions before 1.0.42 contain two critical flaws. One allows unauthenticated disk exhaustion, while the other permits rule bypasses for authenticated users. According to the National Vulnerability Database, the issue carries a CVSS score of 9.3.
In plain English
The plugin caches translation data for any language code received at an unauthenticated endpoint. Attackers send small requests that store about 560 KB each. This process can exhaust disk space or APCu memory on the server. Additionally, older versions fail to check page rules during sync operations. This allows users with write access to create pages in restricted areas.
The background
The National Vulnerability Database records CVE-2026-112779 for this issue. The weakness is classified as CWE-770. The flaw exists in the translation endpoint for versions 1.0.40 through 1.0.41. The authorization bypass affects versions 1.0.16 through 1.0.41. As Vuln Post reported on 2026-10-16, OpenNextJS Cloudflare also faced a cache bypass issue. This incident differs by focusing on resource exhaustion rather than data leakage.
What changes now
Version 1.0.42 fixes these vulnerabilities. Teams must verify if they run affected versions. The Grav API plugin requires an update to version 1.0.42 or later to mitigate these risks. Until then, systems remain vulnerable to both storage exhaustion and unauthorized page creation. Administrators should monitor disk usage and APCu memory levels closely.
Who needs to act first
Teams should prioritize systems exposed to the public internet. Check whether the API plugin is enabled on production servers. If an update is available, test it in a staging environment first. Back up configuration files before applying any changes. If no patch exists, restrict access to the API endpoints using firewall rules. Monitor logs for unusual translation requests or sync activities. Isolate affected instances if resource usage spikes unexpectedly.
What to do and how to stay safe: Grav
- Identify all servers running Grav API plugin versions before 1.0.42.
- Restrict access to the translation endpoint using network-level controls.
- Monitor disk space and memory usage for sudden increases.
- Review API user permissions to limit write access where possible.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Grav API plugin are affected?
Versions before 1.0.42 are affected by CVE-2026-112779.
Can unauthenticated attackers bypass page rules?
No, unauthenticated attackers can only exhaust disk or memory. Authenticated users with write access can bypass rules.
Is there a fix available?
Version 1.0.42 fixes these vulnerabilities.
