CVE-2026-32730

ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in "@apostrophecms/express/index.js" lines 386-389 contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/M...