CVE-2026-113669

A flaw was found in ApostropheCMS. During cross-host or cross-locale session migration, the application exposes single-use bearer session tokens in redirect Uniform Resource Locators URLs. An attacker who intercepts or obtains a valid, unconsumed token before the legitimate user can redeem it to...

CVE-2026-113666

A flaw was found in ApostropheCMS. An authenticated remote user with draft viewing permissions can supply a specially crafted query projection path when database adapters such as SQLite or PostgreSQL are configured. This action causes the application to delete shared internal runtime properties,...

Exposure Of Sensitive Information

ApostropheCMS is vulnerable to Exposure of Sensitive Information. The vulnerability is due to predictable export archive filenames and publicly readable export storage, which allows an unauthenticated attacker to download another user's exported data before the archive expires or is removed...

ApostropheCMS: Color Field Validation Bypass Allows Stored XSS Via HTML Appended After Rgb()/hsl() Prefix

Summary The color field accepts any string that begins with a valid "rgb" / "hsl" color, because "TinyColor.isValid" does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered ,...

ApostropheCMS: GET /api/v1/@apostrophecms/page/:id Bypasses ViewRole Restriction And Exposes ViewPermission-gated Fields

Summary The "getOne" REST endpoint for pages does not apply "viewRole" type-level restrictions or "viewPermission" field-level redaction. An editor-level user who knows a document "id" can read the full content of admin-only pages and their privileged fields, while the "getAll" endpoint correctly...

ApostropheCMS: Missing Authentication In `cleanExport` Route

1. Summary The API endpoint "POST /api/v1/@apostrophecms/import-export/clean-export" in "@apostrophecms/import-export" lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

ApostropheCMS: Unauthenticated PublicApiProjection Bypass Via Search And Sort Query Builders In The Public REST API

Summary ApostropheCMS lets a module expose an anonymous read API by setting "publicApiProjection", which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string before forcing that projection. Two of...

ApostropheCMS: Archive Duplicate Continuation Lets Contributors Overwrite Published Content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken Discloses Existence Of Private/admin-only Content To Any Authen

Summary The "slugTaken" endpoint returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user including editors can enumerate the slug space of private pages, drafts, and archived content. Details "POS...

ApostropheCMS Sanitize-html: Unbounded Recursion When Re-sanitizing The Fallback Of A Discarded Iframe (stack Overflow,

Summary Since 2.18.0, when an "" is not allowed and "disallowedTagsMode" is "'discard'" the defaults, its raw-text content is re-sanitized by a recursive call to "sanitizeHtmltext, options" the change from 5564, fixing 5550. The recursion has no bound and starts each nested call with a fresh stat...

ApostropheCMS: Import Archives Can Exhaust Server Storage And Deny Service

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

ApostropheCMS: Stored XSS Via Unescaped Widget Style Attribute Serialization

Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form "string" style field with a CSS "property" and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget...

ApostropheCMS: Import API Bypasses Publication Roles For Protected Content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

EUVD-2026-105103

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames...

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

Summary When a user exports content through @apostrophecms/import-export, the module copies the generated archive into uploadfs at /exports/ and returns a public URL under /uploads/exports/. The filename is fully deterministic: site shortName, document type, a YYYYMMDDHHmmss timestamp, and the...

ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

Summary The slugTaken endpoint returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user including editors can enumerate the slug space of private pages, drafts, and archived content. Details POST...

npm: ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

npm: ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user vulnerability discovered by ? in WordPress npm apostrophe versions 4.34.0...

EUVD-2026-105102

ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user...

GHSA-F66C-MPJ2-3R8H ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

Summary The slugTaken endpoint returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user including editors can enumerate the slug space of private pages, drafts, and archived content. Details POST...

ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

Summary The getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces...