[ Vendor · 46 CVEs ]
apostrophecms
CVEs affecting apostrophecms published in the last 30 days, plus any apostrophecms CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-113710 | 20 Oct 2026 | CVSS 5.9 | ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password GuessingApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current… | Fix |
| CVE-2026-113711 | 20 Oct 2026 | CVSS 7.5 | ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import… | Fix |
| CVE-2026-113711 | 20 Oct 2026 | CVSS 7.5 | ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import… | Fix |
| CVE-2026-113666 | 20 Oct 2026 | CVSS 7.1 | ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of serviceApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with… | Fix |
| CVE-2026-113666 | 20 Oct 2026 | CVSS 7.1 | ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of serviceApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with… | Fix |
| CVE-2026-113667 | 20 Oct 2026 | CVSS 5.3 | ApostropheCMS: CAPTCHA response token not URL-encodedApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of… | Fix |
| CVE-2026-113667 | 20 Oct 2026 | CVSS 5.3 | ApostropheCMS: CAPTCHA response token not URL-encodedApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of… | Fix |
| CVE-2026-113668 | 20 Oct 2026 | CVSS 5.3 | ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the… | Fix |
| CVE-2026-113669 | 20 Oct 2026 | CVSS 5.3 | ApostropheCMS: Cross-domain session token in URL confers session takeoverApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or… | Fix |
| CVE-2026-113669 | 20 Oct 2026 | CVSS 5.3 | ApostropheCMS: Cross-domain session token in URL confers session takeoverApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or… | Fix |
| CVE-2026-113671 | 20 Oct 2026 | CVSS 4.3 | ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRFApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with… | Fix |
| CVE-2026-113671 | 20 Oct 2026 | CVSS 4.3 | ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRFApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with… | Fix |
| CVE-2026-113659 | 20 Oct 2026 | CVSS 6.1 | ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated usersApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query… | Fix |
| CVE-2026-113660 | 20 Oct 2026 | CVSS 4.3 | ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft IdentifiersApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated… | Fix |
| CVE-2026-113661 | 20 Oct 2026 | CVSS 5.4 | ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to… | Fix |
| CVE-2026-113662 | 20 Oct 2026 | CVSS 5.4 | ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified documentApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import… | Fix |
| CVE-2026-113662 | 20 Oct 2026 | CVSS 5.4 | ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified documentApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import… | Fix |
| CVE-2026-113664 | 20 Oct 2026 | CVSS 5.3 | ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a… | Fix |
| CVE-2026-113664 | 20 Oct 2026 | CVSS 5.3 | ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a… | Fix |
| CVE-2026-113665 | 20 Oct 2026 | CVSS 3.7 | ApostropheCMS: Missing Authorization on Notification PATCH/DELETE EndpointsApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints… | Fix |
| CVE-2026-113652 | 20 Oct 2026 | CVSS 5.6 | ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token… | Fix |
| CVE-2026-113653 | 20 Oct 2026 | CVSS 6.9 | ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer… | Fix |
| CVE-2026-113654 | 20 Oct 2026 | CVSS 5.3 | ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content renderApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to… | Fix |
| CVE-2026-113655 | 20 Oct 2026 | CVSS 4.3 | ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorizationApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a… | Fix |
| CVE-2026-113656 | 20 Oct 2026 | CVSS 5.3 | ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoSApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages… | Fix |
| CVE-2026-113656 | 20 Oct 2026 | CVSS 5.3 | ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoSApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages… | Fix |
| CVE-2026-113657 | 20 Oct 2026 | CVSS 3.7 | ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From… | Fix |
| CVE-2026-113658 | 20 Oct 2026 | CVSS 7.5 | ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a… | Fix |
| CVE-2026-113648 | 20 Oct 2026 | CVSS 3.1 | ApostropheCMS: Missing Authentication in `cleanExport` RouteApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST… | Fix |
| CVE-2026-113648 | 20 Oct 2026 | CVSS 3.1 | ApostropheCMS: Missing Authentication in `cleanExport` RouteApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST… | Fix |
| CVE-2026-113649 | 20 Oct 2026 | CVSS 6.5 | ApostropheCMS: Import API bypasses publication roles for protected contentApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an… | Fix |
| CVE-2026-113649 | 20 Oct 2026 | CVSS 6.5 | ApostropheCMS: Import API bypasses publication roles for protected contentApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an… | Fix |
| CVE-2026-113650 | 20 Oct 2026 | CVSS 5.3 | ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is… | Fix |
| CVE-2026-113651 | 20 Oct 2026 | CVSS 3.3 | ApostropheCMS: Path traversal in uploadfsApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0… | Fix |
| CVE-2026-112957 | 20 Oct 2026 | CVSS 4.3 | ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged usersApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole… | Fix |
| CVE-2026-112958 | 20 Oct 2026 | CVSS 5.4 | ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute SerializationApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an… | Fix |
| CVE-2026-112952 | 20 Oct 2026 | CVSS 4.3 | ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated userApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body { "slug"… | Fix |
| CVE-2026-112953 | 20 Oct 2026 | CVSS 6.0 | ApostropheCMS: Exposure of Sensitive Information via predictable export filenamesApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames… | Fix |
| CVE-2026-112953 | 20 Oct 2026 | CVSS 6.0 | ApostropheCMS: Exposure of Sensitive Information via predictable export filenamesApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames… | Fix |
| CVE-2026-112954 | 20 Oct 2026 | CVSS 5.3 | ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST APIApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose… | Fix |
| CVE-2026-112955 | 20 Oct 2026 | CVSS 6.5 | ApostropheCMS: Import archives can exhaust server storage and deny serviceApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit… | Fix |
| CVE-2026-112955 | 20 Oct 2026 | CVSS 6.5 | ApostropheCMS: Import archives can exhaust server storage and deny serviceApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit… | Fix |
| CVE-2026-112956 | 20 Oct 2026 | CVSS 6.5 | ApostropheCMS: Archive duplicate continuation lets contributors overwrite published contentApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts… | Fix |
| CVE-2026-112956 | 20 Oct 2026 | CVSS 6.5 | ApostropheCMS: Archive duplicate continuation lets contributors overwrite published contentApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts… | Fix |
| CVE-2026-112951 | 20 Oct 2026 | CVSS 5.4 | ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb() or… | Fix |
| CVE-2026-110904 | 15 Oct 2026 | CVSS 5.3 | ApostropheCMSApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call. |