Apostrophecms

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Apostrophecms product.

RSS Feeds for Apostrophecms security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Apostrophecms products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Apostrophecms Sorted by Most Security Vulnerabilities since 2018

Apostrophecms Sanitize Html11 vulnerabilities

Apostrophecms3 vulnerabilities

By the Year

In 2026 there have been 55 vulnerabilities in Apostrophecms with an average score of 5.9 out of ten. Apostrophecms did not have any published security vulnerabilities last year. That is, 55 more vulnerabilities have already been reported in 2026 as compared to last year.

Year	Vulnerabilities	Average Score
2026	55	5.93
2025	0	0.00
2024	1	5.30
2023	0	0.00
2022	1	7.50
2021	4	6.45

It may take a day or so for new Apostrophecms vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Apostrophecms Security Vulnerabilities

CVE	Date	Vulnerability
CVE-2026-113711	Oct 20, 2026	ApostropheCMS <4.33.0 / import-export <3.7.0 Unauth Upload Bypass ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storage, temporary processing, and attacker-declared cleanup work before the later user check rejects the import. This issue is fixed in ApostropheCMS 4.33.0 and import-export 3.7.0.
CVE-2026-113710	Oct 20, 2026	ApostropheCMS <4.33.0 Password Change Brute-Force Bypass ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login modules failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. This issue is fixed in version 4.33.0.
CVE-2026-113671	Oct 20, 2026	ApostropheCMS AI Helper SSRF before 1.0.0beta.13 ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local relative storage with no trusted global base URL. The server resolves the fixed uploads path against a request-controlled Host-derived origin, enabling bounded server-side requests to an attacker-selected host, port, and HTTP origin, but not arbitrary-path retrieval or the stored-provider and absolute-storage configurations. This issue is fixed in AI helper 1.0.0-beta.13.
CVE-2026-113669	Oct 20, 2026	ApostropheCMS <4.33.0 & passport-bridge <1.6.1 Session Token Hijack via Redirect ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This issue is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.
CVE-2026-113667	Oct 20, 2026	ApostropheCMS CAPTCHA token smuggle in Form & addons pre1.5.5/1.2.1/1.3.0 ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated form or login flows; automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure is not established. This issue is fixed in Form 1.5.5, login-recaptcha 1.2.1, and login-hcaptcha 1.3.0.
CVE-2026-113668	Oct 20, 2026	ApostropheCMS <4.33.0 Auth Bypass Disclosure via GET /api/v1/... route ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is fixed in version 4.33.0.
CVE-2026-113666	Oct 20, 2026	Prototype Pollution in ApostropheCMS db-connect <1.1.0 & 4.33.0 ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.
CVE-2026-113665	Oct 20, 2026	ApostropheCMS <4.33.0 Notification API Auth Bypass (PATCH/DELETE) ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.
CVE-2026-113664	Oct 20, 2026	ApostropheCMS importexport <3.7.0 DoS via tar path bypass ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.
CVE-2026-113662	Oct 20, 2026	ApostropheCMS import-export <3.7.0 Auth Object Injection via Update-Key ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits the candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content. This issue is fixed in version 3.7.0.