CVE-2026-113649

Deferred Deferred - Pending Action

Privilege Escalation in ApostropheCMS via Import Export Module

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: GitHub, Inc.

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove published variants without the normal publish permission and lifecycle checks. This issue is fixed in import-export 3.7.1 and ApostropheCMS 4.34.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113649

EUVD

EUVD-2026-105184

Affected Vendors & Products

Vendor	Product	Version / Range
apostrophecms	apostrophe	< 4.34.0
@apostrophecms	import-export	< 3.7.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

ApostropheCMS is a Node.js content management system. This vulnerability allows an editor with limited import permissions to bypass normal publish checks and create, replace, or remove published content variants without proper authorization. It affects versions before 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS.

Detection Guidance

To detect this vulnerability, check the versions of ApostropheCMS and the import-export module. Run commands like 'npm list @apostrophecms/import-export' and 'npm list apostrophe' to verify if versions are below 3.7.1 or 4.34.0 respectively. If outdated, the system is vulnerable.

Impact Analysis

An attacker with editor access could modify published content without approval, potentially altering or deleting important information. This could lead to data integrity issues, unauthorized changes to live content, or disruption of services relying on the CMS.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and audit trails for content changes, such as GDPR's data integrity principles or HIPAA's access controls for protected health information. Unauthorized content modifications may lead to non-compliance.

Mitigation Strategies

Update ApostropheCMS to version 4.34.0 or later and update the @apostrophecms/import-export module to version 3.7.1 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-113649. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...