CVE-2026-113649 ApostropheCMS: Import API bypasses publication roles for protected content

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove...

CVE-2026-112953

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. ...

CVE-2026-112955

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failure...

CVE-2026-112956

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an...

CVE-2026-113648

The ApostropheCMS Node.js content management system contains a vulnerability in the @apostrophecms/import-export module prior to version 3.7.1 . The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export lacks necessary authentication and authorization checks. This allows any client,...

CVE-2026-113648 ApostropheCMS: Missing Authentication in `cleanExport` Route

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticate...

CVE-2026-113648 ApostropheCMS: Missing Authentication in `cleanExport` Route

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticate...

CVE-2026-113648

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticate...

CVE-2026-112956 ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an...

CVE-2026-112956

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an...

CVE-2026-112956 ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an...

CVE-2026-112956 ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an...

CVE-2026-112956

ApostropheCMS, an open-source Node.js content management system, contains an incorrect authorization vulnerability (CWE-863) in the import-export module prior to version 3.7.1 . The duplicate-import continuation fails to bind client-controlled replacement choices to a server-side analysis or auth...

CVE-2026-112955

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failure...

CVE-2026-112955

The ApostropheCMS Node.js content management system is vulnerable to a denial-of-service (DoS) condition in the import-export module prior to version 3.7.1 . An authenticated importer can submit archives with unbounded decompressed bytes, entry counts, and entry sizes. Because these values are no...

CVE-2026-112955 ApostropheCMS: Import archives can exhaust server storage and deny service

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failure...

CVE-2026-112955 ApostropheCMS: Import archives can exhaust server storage and deny service

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failure...

CVE-2026-112953

The ApostropheCMS content management system is vulnerable to an information exposure flaw in the import-export module prior to version 3.7.1 . The root cause is the use of predictable export archive filenames , which allows an unauthenticated requester to download another user's export from publi...

CVE-2026-112953 ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. ...

CVE-2026-112953

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. ...