Grav API Plugin EUVD-2026-104585

The Grav API plugin (grav-plugin-api) must be installed and enabled - it is an optional add-on, not part of a default Grav install, which limits exposure. The cache-exhaustion DoS needs no authentication and works against the default configuration of the plugin: the unauthenticated GET /api/v1/translations/{lang} endpoint caches a full dictionary (~560 KB) for every well-formed language code, so it is exploitable by any remote attacker who can reach the endpoint. The permission-bypass path is strictly limited: it requires an authenticated account holding the api.pages.write capability and only affects the sync and batch copy endpoints, where target/destination page rules are not enforced.

This CVE bundles two distinct weaknesses with sharply different risk profiles, and the input signals partly conflict. The unauthenticated path (CWE-770 resource exhaustion) is genuine and low-barrier: GET /api/v1/translations/{lang} caches ~560 KB per well-formed language code with no authentication, so an attacker can cheaply exhaust disk or APCu - a pure availability attack. The second path (sync/batch-copy permission bypass that overwrites translations or creates pages) delivers the confidentiality/integrity impact but REQUIRES an account with api.pages.write, i.e. it is authenticated. The provided CVSS:4.0 vector (9.3, PR:N with VC:H/VI:H/VA:H) therefore overstates the unauthenticated worst case: it credits full confidentiality/integrity/availability impact at PR:N, but per the description the high C/I impact is gated behind api.pages.write (PR:L), while the PR:N portion yields only availability loss. CWE-770 and the 'Denial Of Service' tag align with the availability-only reading of the unauthenticated bug. No EPSS score, no KEV listing, and no POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a real priority for any site actually running the Grav API plugin (trivial unauthenticated DoS), but the CRITICAL 9.3 rating is driven by impacts that require authentication - verify the PR:N/impact combination against the GHSA advisory.

An unauthenticated attacker scripts repeated small GET requests to /api/v1/translations/{lang}, iterating distinct well-formed language codes; each response caches roughly 560 KB, so a few thousand requests fill the cache store and exhaust disk or APCu, taking the site offline. Separately, an attacker who already holds an api.pages.write token uses the sync or batch-copy endpoints to overwrite translations or create pages in locations that page-level rules should deny. No public exploit code was provided in the intelligence.