CVE-2026-113652

Deferred Deferred - Pending Action

SAS Token Exposure in ApostropheCMS Azure Uploads

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: GitHub, Inc.

Description

ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113652

EUVD

EUVD-2026-105180

Affected Vendors & Products

Vendor	Product	Version / Range
apostrophecms	apostrophe	< 4.33.0
apostrophecms	uploadfs	>= 1.25.0, < 1.28.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

ApostropheCMS versions 1.25.0 to 1.28.0 have a flaw in the uploadfs Azure backend. When configured with sas: true, it leaks account-level SAS tokens into public attachment URLs. The createContainer() function builds a BlobServiceClient URL containing the full SAS query string, which is then exposed in every public attachment link generated by Apostrophe's attachment.url().

Detection Guidance

Check if your ApostropheCMS uses uploadfs Azure backend with sas: true in versions 1.25.0 to 1.27.0. Inspect public attachment URLs for embedded SAS tokens using browser developer tools or curl commands like curl -s <attachment-url> | grep -i "sig=".

Impact Analysis

This vulnerability allows any visitor to access, modify, or delete files in the Azure container associated with the leaked SAS token. Attackers could read sensitive data, overwrite files, or delete content. The impact includes unauthorized data exposure and potential data loss.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access and exposure. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade uploadfs to version 1.28.0 or later. If upgrading is not possible, disable public access to attachments or regenerate SAS tokens with least privileges. Avoid using sas: true in Azure backend configuration.

Hi! I’m here to help you understand CVE-2026-113652. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...