508 matches found
CVE-2026-110904
ApostropheCMS versions before 4.33.0 are vulnerable to an authentication bypass that allows unauthorized reading of pages via the REST API. The vulnerability can be triggered by making a call to the /api/v1/@apostrophecms/page?all=1 endpoint. This issue is associated with CWE-863 (Incorrect Autho...
EUVD-2026-101804
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call...
PT-2026-114428
Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description An authentication bypass exists that allows unauthorized reading of pages via the REST API. This can be triggered by making a call to the endpoint '/api/v1/@apostrophecms/page' using the all...
CVE-2026-110904: Incorrect Authorization
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call...
CLEANSTART-2026-LG36939 ApostropheCMS is an open-source Node
Security vulnerability affects the n8n package. ApostropheCMS is an open-source Node...
CLEANSTART-2026-VM49964 ApostropheCMS is an open-source Node
Security vulnerability affects the n8n package. ApostropheCMS is an open-source Node...
NPM: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
NPM: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close vulnerability discovered by ? in WordPress Npm sanitize-html versions = 2.17.5...
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
Summary A mutation-XSS / allowedTags bypass: when textarea or xmp is included in allowedTags, an input containing a literal a solidus right after the RCDATA end-tag name lets non-allowed markup such as pass through sanitizeHtml live and unescaped, even though img/onerror are not in the allowlist....
EUVD-2026-60440
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close...
ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare editRole / publishRole and the core @apostrophecms/archive-page does, so a project can have page-type subtrees that only higher-privileged roles are allowed to create or edit within. The move operation is...
NPM: ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
NPM: ApostropheCMS: Missing destination-parent authorization in page move allows a low-privileged editor to move and re-rank pages inside a restricted subtree vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.31.0...
GHSA-WR5R-WQP2-X4FH ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare editRole / publishRole and the core @apostrophecms/archive-page does, so a project can have page-type subtrees that only higher-privileged roles are allowed to create or edit within. The move operation is...
EUVD-2026-60438
ApostropheCMS: Missing destination-parent authorization in page move allows a low-privileged editor to move and re-rank pages inside a restricted subtree...
GHSA-VMG4-6GFG-83QX ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
The vulnerability is a single-request persistent DoS by submitting e.g. "PATCH /api/v1/article/" with a valid editor session and body of "toString.call":"x", overwriting the global toString function with value x. Fabian...
EUVD-2026-60442
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS...
NPM: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
NPM: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.32.0...
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
The vulnerability is a single-request persistent DoS by submitting e.g. "PATCH /api/v1/article/" with a valid editor session and body of "toString.call":"x", overwriting the global toString function with value x. Fabian...
GHSA-79QF-VQGC-7XX3 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
Summary The @apostrophecms/import-export module reconstructs the on-disk source path of every imported attachment from JSON metadata contained in the uploaded archive. The archive carries an aposAttachments.json file whose name and extension fields are concatenated into a filesystem path with no...
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
Summary The @apostrophecms/import-export module reconstructs the on-disk source path of every imported attachment from JSON metadata contained in the uploaded archive. The archive carries an aposAttachments.json file whose name and extension fields are concatenated into a filesystem path with no...