CVE-2026-113665

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target...

CVE-2026-113659

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the specia...

CVE-2026-113664

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a wri...

ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

Summary CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes action, formaction, data, poster, background, later ping, xlink:href, … go through naughtyHref. A URL nested inside meta content http-equiv=refresh is not an attribute name on that list, so the embedded...

GHSA-CV27-6WVH-8X7J ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

Summary CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes action, formaction, data, poster, background, later ping, xlink:href, … go through naughtyHref. A URL nested inside meta content http-equiv=refresh is not an attribute name on that list, so the embedded...

NPM: ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

NPM: ApostropheCMS: Incomplete CVE-2026-53606: meta http-equiv=refresh content still ships javascript: / data: URLs vulnerability discovered by ? in WordPress npm sanitize-html versions 2.18.0...

ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

Summary The REST route GET /api/v1//:id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document id and learn whether the document exists and which...

GHSA-GQH3-7856-RJJG ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

Summary The REST route GET /api/v1//:id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document id and learn whether the document exists and which...

NPM: ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

NPM: ApostropheCMS: :id/locales REST route omits the public-API authorization gate its sibling read routes enforce unauthenticated doc-existence + locale metadata disclosure vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

ApostropheCMS: Page REST API authorization bypass

Summary The core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public...

NPM: ApostropheCMS: Page REST API authorization bypass

NPM: ApostropheCMS: Page REST API authorization bypass vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

Summary The @apostrophecms/ai-helper package builds the URL for a server-side image fetch by resolving a storage-relative path against req.baseUrl. When the site does not set a global base URL the default, req.baseUrl is derived from the incoming HTTP Host header. An authenticated editor can...

ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory

Summary A rejected upload can remain in the operating system temporary directory. Multer writes the file before its extension is checked, and the rejection path does not remove that temporary file. An unauthenticated requester can repeat this with large files and steadily consume temporary disk...

NPM: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory

NPM: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

ApostropheCMS: Cross-domain session token in URL confers session takeover

Summary Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session including passport.user with no credentials. Details...

NPM: ApostropheCMS: Cross-domain session token in URL confers session takeover

NPM: ApostropheCMS: Cross-domain session token in URL confers session takeover vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

Summary The form submission endpoint runs multer dest: os.tmpdir .any before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is receive...

ApostropheCMS: CAPTCHA response token not URL-encoded

Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request. Details - packages/form/lib/recaptcha.js:39 — recaptchaUri =...

ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare editRole / publishRole the core @apostrophecms/archive-page does, so a project can define restricted subtrees that only higher-privileged roles may create or edit within. The move operation in the...

GHSA-2JRP-QC93-H2J8 ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare editRole / publishRole the core @apostrophecms/archive-page does, so a project can define restricted subtrees that only higher-privileged roles may create or edit within. The move operation in the...