The Grav API plugin stores a complete translation dictionary in memory for every well‑formed language code received at the unauthenticated GET /api/v1/translations/{lang} endpoint. Each request can occupy roughly 560 KB of disk or APCu storage, causing a storage or memory exhaustion that can bring the API and potentially the entire Grav site offline. Additionally, older versions of the plugin ignore target and destination page rules during sync and batch copy operations; account holders with the api.pages.write permission can therefore overwrite translations or create pages in locations that page‑level rules are designed to deny, effectively bypassing authorization controls.

This flaw affects Grav CMS installations that use the Grav API plugin before version 1.0.42, specifically plugin releases 1.0.16 through 1.0.41 and 1.0.40 through 1.0.41. Any site exposing the API endpoints without proper access controls is vulnerable unless the plugin is updated.

With a CVSS score of 9.3, the vulnerability is high severity. The denial‑of‑service vector is unauthenticated, requiring only the ability to send a small HTTP GET request to the translations endpoint. The authorization bypass requires an account that already has api.pages.write privileges; there is no evidence that the EPSS score is substantially high, but the lack of a KEV listing does not preclude targeted exploitation. Attackers who can access the API can exhaust resources quickly and/or modify critical content without consent.