CVE-2026-113666
Deferred Deferred - Pending Action

Prototype Pollution Leading to Persistent Integrity Issues in ApostropheCMS

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-22
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113666
EUVD
EUVD-2026-105214

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apostrophecms apostrophe < 4.33.0
@apostrophecms db-connect < 1.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ApostropheCMS allows authenticated users with view-draft access (or any logged-in user if guestApiAccess is enabled) to exploit a flaw in db-connect versions below 1.1.0. By sending a crafted REST GET request with a projection exclusion key targeting a shared prototype method like Object.prototype.hasOwnProperty, the unsetNestedField helper in SQLite or PostgreSQL adapters deletes the method. This causes persistent denial of service across the entire Node.js process, affecting all users and tenants until a restart.

Detection Guidance

Check if your ApostropheCMS version is below 4.33.0 or db-connect version is below 1.1.0. Monitor for unusual process crashes or errors in logs related to projection queries. Look for requests targeting Object.prototype.hasOwnProperty or similar prototype methods.

Impact Analysis

The vulnerability can lead to a complete denial of service for the ApostropheCMS instance. All users may experience broken request handling, and the system may become unavailable until the Node.js process is restarted. This affects all tenants and users sharing the same process.

Compliance Impact

This vulnerability could lead to persistent denial of service (DoS) across the entire Node.js process, disrupting availability of ApostropheCMS services. For GDPR, this may impact availability of personal data processing systems, potentially violating Article 32 (security of processing). For HIPAA, it could disrupt access to protected health information systems, affecting integrity and availability requirements under the Security Rule.

Mitigation Strategies

Upgrade ApostropheCMS to version 4.33.0 or higher and db-connect to version 1.1.0 or higher. If immediate upgrade is not possible, restrict access to authenticated users with view-draft privileges and disable guestApiAccess if enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113666. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart