CVE-2026-71553

🗓️ 17 Aug 2026 20:03:37Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 21 Views🌐 WEB

ApostropheCMS up to 4.32.0 lets authenticated editors overwrite Object.prototype.toString causing persistent DoS.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-71553	17 Aug 202620:03	–	attackerkb
Circl	CVE-2026-71553	17 Aug 202620:52	–	circl
Cvelist	CVE-2026-71553 ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS	17 Aug 202620:03	–	cvelist
EUVD	EUVD-2026-60442	2 Sep 202615:12	–	euvd
Github Security Blog	ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS	2 Sep 202615:12	–	github
NVD	CVE-2026-71553	17 Aug 202620:16	–	nvd
OSV	GHSA-VMG4-6GFG-83QX ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS	2 Sep 202615:12	–	osv
Patchstack	NPM: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS	2 Sep 202615:12	–	patchstack
Positive Technologies	PT-2026-76776	17 Aug 202600:00	–	ptsecurity
Snyk	Allocation of Resources Without Limits or Throttling	18 Aug 202600:47	–	snyk

Vulners

Node

apostrophecms apostrophecmsRange≤4.32.0

[
  {
    "vendor": "apostrophecms",
    "product": "apostrophe",
    "versions": [
      {
        "version": "<= 4.32.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmg4-6gfg-83qx
github	www.github.com/apostrophecms/apostrophe/commit/5a3746aaed49761e171c2cbfe793267c959829fd

Parameter	Position	Path	Description	CWE
body	request body	/api/v1/article/:id	PATCH endpoint allows overwriting Object.prototype.toString.call via crafted input, enabling a persistent process-wide denial of service.	CWE-1321

17 Aug 2026 20:16Current

5.4Medium risk

Vulners AI Score5.4

CVSS 47.1

EPSS0.00312

SSVC

CWE-1321