CVE-2026-113662
Received Received - Intake

Authenticated Object Injection in ApostropheCMS Import-Export Module

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits the candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content. This issue is fixed in version 3.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113662
EUVD
EUVD-2026-105210

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apostrophecms apostrophe < 4.33.0
@apostrophecms import-export < 3.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS's import-export module before version 3.7.0 has a NoSQL injection flaw. An authenticated user with import access can supply a MongoDB operator like $ne as an update-key value. This bypasses normal document matching and allows overwriting an unintended existing document that the user has edit rights on.

Detection Guidance

Check if your ApostropheCMS import-export module version is below 3.7.0. Review import logs for suspicious queries containing MongoDB operators like $ne. Inspect documents for unexpected modifications by contributors.

Impact Analysis

An attacker with contributor-level access could overwrite existing documents, such as changing titles or content of unrelated articles. This could lead to data corruption or misinformation if the affected documents are visible to other users.

Compliance Impact

This vulnerability could lead to unauthorized data modification, potentially violating integrity requirements in GDPR and HIPAA. If sensitive content is altered, it may result in non-compliance with data accuracy and protection obligations.

Mitigation Strategies

Upgrade the import-export module to version 3.7.0 or later. Restrict import access to trusted users only. Monitor document changes for unauthorized modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113662. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart