CVE-2026-113710 ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated...

CVE-2026-113710

The ApostropheCMS Node.js content management system is vulnerable to unlimited current-password guessing on the self-service password-change endpoint in versions prior to 4.33.0 . The root cause is the absence of the login module’s failed-attempt counter, throttling, delay, or lockout mechanisms ...