{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/grav-api-plugin-1.0.16-1.0.41/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:getgrav:grav_api_plugin:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-112779"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Grav API plugin (1.0.16-1.0.41)"],"_cs_severities":["critical"],"_cs_tags":["denial-of-service","broken-access-control","grav","cms"],"_cs_type":"advisory","_cs_vendors":["Grav"],"content_html":"\u003cp\u003eThe Grav API plugin (grav-plugin-api) versions 1.0.16 through 1.0.41 are affected by two critical security vulnerabilities. The first issue involves an unauthenticated resource exhaustion vulnerability in the translations endpoint. By sending requests to the GET /api/v1/translations/{lang} endpoint with varying language codes, an attacker can force the system to cache full translation dictionaries, rapidly exhausting available disk space or APCu memory.\u003c/p\u003e\n\u003cp\u003eThe second vulnerability is an authorization bypass affecting the sync and batch copy endpoints. Users possessing the api.pages.write permission can leverage these endpoints to perform operations on pages that are restricted by page-level rules. This allows for the unauthorized creation of pages or the modification of site translations. Attackers exploiting the resource exhaustion vulnerability can potentially crash the service, while those exploiting the authorization bypass can circumvent site-specific access policies to inject or modify content.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of the resource exhaustion vulnerability results in a Denial of Service (DoS) condition by filling the application cache or disk space, potentially impacting site availability. Exploitation of the authorization bypass allows users with limited 'api.pages.write' access to escalate their capabilities to perform prohibited page modifications, potentially leading to unauthorized data modification or administrative policy violation within the Grav CMS environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Grav API plugin to version 1.0.42 or later to address both the translation cache resource exhaustion and the authorization bypass in sync and batch copy endpoints.\u003c/li\u003e\n\u003cli\u003eAudit logs for the \u003ccode\u003e/api/v1/translations/\u003c/code\u003e endpoint to identify high volumes of requests from single IP addresses that could indicate resource exhaustion attempts.\u003c/li\u003e\n\u003cli\u003eReview permissions for all users assigned the \u003ccode\u003eapi.pages.write\u003c/code\u003e capability to ensure strict adherence to the principle of least privilege, especially if the site relies on page-level access control.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T22:23:30Z","date_published":"2026-10-19T22:23:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-grav-api-vulnerabilities/","summary":"The Grav API plugin for Grav CMS contains multiple vulnerabilities allowing unauthenticated resource exhaustion and authorized users to bypass page-level access controls.","title":"Grav API Plugin Denial of Service and Authorization Bypass Vulnerabilities","url":"https://feed.craftedsignal.io/briefs/2026-10-grav-api-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - Grav API Plugin (1.0.16-1.0.41)","version":"https://jsonfeed.org/version/1.1"}