Vulnerabilidades do Npm Apostrophe

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Npm Apostrophe: 8 registro(s), com versões afetadas e correções.

CVE-2026-113710 Média · 5.9 CWE-307 20/10/2026

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. This issue is fixed in version 4.33.0.

CVE-2026-113670 Média · 5.3 CWE-863 20/10/2026

ApostropheCMS: Page REST API authorization bypass

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by _id/slug. This issue is fixed in version 4.33.0.

CVE-2026-113669 Média · 5.3 CWE-598 20/10/2026

ApostropheCMS: Cross-domain session token in URL confers session takeover

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This issue is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.

CVE-2026-113668 Média · 5.3 CWE-200 20/10/2026

ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is fixed in version 4.33.0.

CVE-2026-113666 Alta · 7.1 CWE-400 20/10/2026

ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service

ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.

CVE-2026-113665 Baixa · 3.7 CWE-639 20/10/2026

ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.

CVE-2026-113660 Média · 4.3 CWE-862 20/10/2026

ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.

CVE-2026-113659 Média · 6.1 CWE-79 20/10/2026

ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special __proto__, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session; anonymous visitors do not load the affected admin context. This issue is fixed in version 4.33.0.