ApostropheCMS: Batch of 25 Vulnerabilities Disclosed, Affecting Core and Modules

Key findings

• 25 CVEs disclosed for ApostropheCMS on Oct 20, 2026, impacting core and modules.
• High severity flaws include unauthenticated upload initialization (CVE-2026-113711) and insecure file handling (CVE-2026-113658).
• Vulnerabilities span authentication bypass, authorization flaws, path traversal, and denial-of-service risks.
• Multiple modules affected, including import-export, Form add-on, and sanitize-html.
• All issues addressed in ApostropheCMS 4.33.0 and related module updates.

On October 20, 2026, a significant batch of 25 vulnerabilities was disclosed for ApostropheCMS, an open-source Node.js content management system. These vulnerabilities, disclosed within a one-hour window, span various components and impact different aspects of the system's security, ranging from authentication bypass to data exposure and denial-of-service risks. The sheer volume and diversity of these issues highlight the need for diligent patching and security review by ApostropheCMS users.

Several vulnerabilities revolve around improper handling of uploads and file processing. CVE-2026-113711, a High severity flaw, allows unauthenticated requests to initiate upload processes due to a missing authorization callback in bigUploadMiddleware. Similarly, CVE-2026-113658, another High severity issue, involves an unauthenticated route that writes multipart uploads to a temporary directory without proper validation, potentially leading to denial-of-service through repeated large uploads. CVE-2026-113610 and CVE-2026-113664, both related to the import-export module, allow authenticated users to bypass security checks, leading to unintended data manipulation or file system access. CVE-2026-113656 and CVE-2026-113617 also detail issues with unbounded multipart uploads in the Form add-on and sanitize-html, respectively, which can be exploited by unauthenticated attackers to consume temporary storage.

Authentication and authorization appear to be recurring themes. CVE-2026-113668 indicates that a REST route for querying page locales bypasses the publicApiCheckAsync gate, allowing unauthenticated access. CVE-2026-113653 points out that when <iframe> tags are disallowed, the sanitization process can recursively re-sanitize content, potentially leading to bypasses. CVE-2026-113659 describes a vulnerability where a crafted link can exploit the apos.http.parseQuery function, allowing prototype pollution, while CVE-2026-113666 details how an account with view-draft access can exploit projection exclusion paths to access shared prototype members, particularly when using SQLite or PostgreSQL. Furthermore, CVE-2026-113651 highlights path traversal vulnerabilities in the local backend of uploadfs, allowing attackers to affect file operations outside the intended directory.

Other notable vulnerabilities include CVE-2026-113670, which bypasses page-type view role and visibility checks for core page REST APIs, exposing private or login-required pages to unauthenticated visitors. CVE-2026-113665 and CVE-2026-113648 describe issues with the notification module and the import-export module's clean-export endpoint, respectively, lacking proper authentication and authorization, allowing unauthorized operations. CVE-2026-113667 points to a flaw in CAPTCHA integrations where user-supplied tokens can smuggle request parameters. CVE-2026-113652 reveals that the uploadfs Azure backend leaks SAS tokens into public attachment URLs. CVE-2026-113655 describes how an authenticated editor can move pages to different sibling ranks without proper authorization on the parent. CVE-2026-113613 allows low-privilege users to determine the existence of restricted documents in specific locales. CVE-2026-113612 involves a potential bypass of sanitize-html's sanitization for meta refresh elements. CVE-2026-113649 details how an editor with import access but lacking publication roles can manipulate published variants. Finally, CVE-2026-113710 notes that the self-service password change endpoint does not utilize the failed-attempt counter, allowing for repeated attempts without throttling.

All identified vulnerabilities were addressed in ApostropheCMS version 4.33.0, with specific module versions also receiving patches, such as the import-export module updated to 3.7.0, AI helper to 1.0.0-beta.13, passport-bridge to 1.6.1, Form add-on to 1.5.5, login-recaptcha to 1.2.1, login-hcaptcha to 1.3.0, db-connect to 1.1.0, and sanitize-html to 2.18.0. Users are strongly advised to update to the latest versions to mitigate these security risks. The comprehensive nature of this disclosure underscores the importance of timely updates for maintaining the security posture of ApostropheCMS deployments.

The batch of 25 CVEs disclosed on October 20, 2026, for ApostropheCMS presents a wide array of security weaknesses, affecting core functionalities and various modules. The vulnerabilities range from critical authentication bypasses and file upload exploits to less severe information disclosure and authorization flaws. The consistent patching across multiple components in version 4.33.0 indicates a coordinated effort by the ApostropheCMS team to address these issues. Users should prioritize updating their systems to prevent potential exploitation.

Key findings from this disclosure include:

• A High severity vulnerability (CVE-2026-113711) allows unauthenticated users to initialize uploads.
• Multiple vulnerabilities (e.g., CVE-2026-113658, CVE-2026-113610) involve insecure file handling and import processes.
• Several issues (e.g., CVE-2026-113668, CVE-2026-113659) stem from inadequate authentication, authorization, or input validation.
• The disclosure impacts core CMS features as well as add-ons like Form, import-export, and AI helper.
• All disclosed vulnerabilities are addressed in ApostropheCMS 4.33.0 and related module updates.
• Path traversal and prototype pollution vulnerabilities were also identified (CVE-2026-113651, CVE-2026-113659).