Understand vulnerabilities. Protect your applications.

ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

In ApostropheCMS prior to 4.34.0, a REST endpoint bypasses page and field access controls, allowing editor-level users to view restricted pages and fields if they know the document identifier.

ApostropheCMS: Private and Admin Content Existence Disclosed via doc/slugTaken Endpoint

A vulnerability in ApostropheCMS allows any authenticated user to enumerate slugs across the system via the doc/slugTaken endpoint, exposing the existence of private, draft, and administrative content.

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS contains a stored cross-site scripting vulnerability where editor-controlled style field values in widgets are serialized into HTML wrapper attributes without escaping, allowing arbitrary script execution.

ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

A stored cross-site scripting vulnerability in ApostropheCMS allows authenticated users with edit permissions to inject arbitrary HTML and JavaScript via trailing content in color fields. Upgrading to version 4.34.0 or later mitigates this issue.

ApostropheCMS: Import API bypasses publication roles for protected content

A vulnerability in ApostropheCMS allows the import API to bypass publication roles, enabling users with edit-only permissions to create, replace, or delete published content without required publishing authority.

ApostropheCMS: Import archives can exhaust server storage and deny service

A vulnerability in ApostropheCMS allows authenticated users to exhaust server storage during archive extraction due to missing decompression quotas and failure cleanup, potentially causing a denial of service.

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

In @apostrophecms/import-export, the overrideDuplicates continuation accepts client-supplied replacement choices, allowing contributors to overwrite published content without publication authority.

ApostropheCMS: General public can access @apostrophecms/user objects via a relationship

A vulnerability in ApostropheCMS allows the general public to access user objects through relationships if templates expose them, as viewRole is not enforced for unauthenticated public users.

ApostropheCMS: Page REST API authorization bypass

An authorization bypass in the ApostropheCMS page REST API allows unauthenticated visitors and low-privileged contributors to read restricted page content and site structure metadata.

ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

A substring check in ApostropheCMS import-export tar extraction fails to catch relative directory traversal paths, allowing authenticated users to crash the Node process.

ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

A client-side prototype pollution vulnerability in ApostropheCMS allows attackers to execute arbitrary JavaScript in the context of an authenticated user session if the victim visits a crafted link, potentially leading to unauthorized data access and administrative compromise.

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

A lack of attempt throttling on ApostropheCMS's authenticated password-change endpoint allows attackers with an active session to repeatedly guess the current password without lockout or rate limiting, potentially enabling account takeover if the password is weak.

ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

In ApostropheCMS before 4.33.0, the exist-in-locale API allows authenticated low-privilege users to determine whether restricted documents and drafts exist and retrieve localized identifiers without proper document-level authorization checks.

ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)

ApostropheCMS uploadfs with the Azure backend and SAS enabled inadvertently exposes container-level SAS tokens in public attachment links. This allows unauthenticated users to read, overwrite, delete, or list blobs stored in the container.

ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

In @apostrophecms/ai-helper, an authenticated editor can supply a crafted Host header to control the server-side image fetch origin, enabling SSRF against internal hosts and ports.