CVE-2026-113710
Received Received - Intake

Password Brute Force in ApostropheCMS

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. This issue is fixed in version 4.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113710
EUVD
EUVD-2026-105221

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apostrophecms apostrophe < 4.33.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS is a Node.js content management system. Before version 4.33.0, its password-change endpoint allowed repeated password guesses without lockout or throttling. The system verified the current password but did not enforce security measures like failed-attempt counters or delays, enabling brute-force attacks.

Impact Analysis

An attacker with a valid session could repeatedly guess the current password without triggering account lockouts. This could lead to unauthorized password changes, account takeover, or data breaches if the attacker gains access to sensitive information.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by enabling unauthorized access to personal or health data. Organizations using affected versions may face compliance failures, legal penalties, or reputational damage due to insufficient security controls.

Mitigation Strategies

Upgrade ApostropheCMS to version 4.33.0 or later to address the missing password-change endpoint security controls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113710. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart