CVE-2026-112951 ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb or hsl prefix because its TinyColor validation does not require the entire value to match a color. An authenticated user with edit rights can store...

CVE-2026-112951 ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb or hsl prefix because its TinyColor validation does not require the entire value to match a color. An authenticated user with edit rights can store...

CVE-2026-112951

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb or hsl prefix because its TinyColor validation does not require the entire value to match a color. An authenticated user with edit rights can store...

CVE-2026-112951 ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb or hsl prefix because its TinyColor validation does not require the entire value to match a color. An authenticated user with edit rights can store...

PT-2026-118489

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description The getOne REST endpoint for pages fails to apply viewRole type-level restrictions and viewPermission field-level redaction. This allows a user with editor-level privileges who possesses a...

PT-2026-118589

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 import-export module versions prior to 3.7.0 Description Import routes invoke bigUploadMiddleware without an early authorize callback. This allows unauthenticated requests to perform upload initialization...

PT-2026-118450

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description A public REST API type utilizing publicApiProjection allows the exposure of excluded searchable or sortable field information. This occurs through search membership and sort ordering oracles,...

PT-2026-118448

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description The application contains an issue where the endpoint 'POST /api/v1/@apostrophecms/doc/slugTaken' does not implement permission or type filters when processing the slug variable in the request...

PT-2026-118490

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description A project-defined free-form widget style field allows an editor-controlled quote to be inserted into an inline style attribute because the wrapper serializer fails to apply HTML-attribute...

PT-2026-118452

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description The import-export module allows duplicate-import continuation to accept replacement choices controlled by the client without binding them to a server-side analysis or...

PT-2026-118451

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description An authenticated importer can submit archives where decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization. Additionally,...

PT-2026-118492

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description The API endpoint 'POST /api/v1/@apostrophecms/import-export/clean-export' lacks authentication and authorization checks. This allows unauthenticated anonymous users with a...

PT-2026-118447

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description The color field allows trailing content after a valid rgb or hsl prefix because the TinyColor validation does not require the entire value to match a color. An authenticated user with edit...

PT-2026-118508

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions 3.x and 4.0.0 through 4.32.2 Description A client-side prototype pollution issue exists in the apos.http.parseQuery function. The parser fails to sanitize the proto , constructor, and prototype keys when processing URL...

PT-2026-118494

Name of the Vulnerable Software and Affected Versions import-export versions prior to 3.7.1 ApostropheCMS versions prior to 4.34.0 Description An editor with permissions to import an enabled content type, but lacking the required publication role, can bypass normal publish permissions and lifecyc...

PT-2026-118449

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description Predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires o...

PT-2026-118495

Name of the Vulnerable Software and Affected Versions sanitize-html version 2.18.0 Description In the sanitize-html library, a recursive call to the sanitizeHtmltext, options function occurs when an tag is not permitted and the disallowedTagsMode is set to 'discard'. Because this recursion lacks ...

CVE-2026-110904

ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call...

CVE-2026-110904

ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call...

CVE-2026-110904

ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call...