88 matches found
ApostropheCMS: Missing Authorization On Notification PATCH/DELETE Endpoints
Summary The notification module exposes "PATCH" and "DELETE" REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid...
Authorization Bypass Through User-Controlled Key
Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...
ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
Summary The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid...
CVE-2026-113665
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target...
CVE-2026-113665 ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target...
CVE-2026-113665
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target...
EUVD-2026-105213
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target...
CVE-2026-113665
The ApostropheCMS open-source Node.js content management system contains a missing authorization vulnerability in its notification module prior to version 4.33.0 . Specifically, the PATCH and DELETE REST endpoints perform operations directly on the underlying MongoDB collection without verifying ...
CVE-2026-113665 ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target...
CVE-2026-113665 ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target...
PT-2026-118513
Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying if the requester is authenticated or own...
Apostrophe Technologies ApostropheCMS Authorization Issues Vulnerability
Apostrophe Technologies’ ApostropheCMS versions prior to 4.33.0 have a vulnerability related to authorization. This vulnerability stems from the notification module exposing PATCH and DELETE REST endpoints that directly operate on the underlying MongoDB collections. No verification is performed t...
Huawei HarmonyOS Permission Control Vulnerability
Huawei HarmonyOS is a distributed operating system developed independently by Huawei, designed for various scenarios. Huawei HarmonyOS has a permission control vulnerability. This vulnerability stems from issues with permission control in the event notification module. Attackers can exploit this...
Huawei HarmonyOS Permission Control Vulnerability (CNVD-2026-37868)
Huawei HarmonyOS is a distributed operating system developed independently by Huawei, designed for various scenarios. Huawei HarmonyOS has a permission control vulnerability, which stems from a flaw in the event notification module’s permission management. Currently, no detailed details about thi...
CVE-2026-49310
Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
EUVD-2026-74597
Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-49310
Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-49310
CVE-2026-49310 is a permission control vulnerability in the event notification module affecting Huawei consumer devices , including phones, Vision, wearables, and laptops (per the September 2026 security bulletins). Successful exploitation may affect service confidentiality . The CVSS 3.1 score i...