High severity8.1NVD Advisory· Published Mar 18, 2026· Updated Jun 17, 2026
CVE-2026-32730
CVE-2026-32730
Description
ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in @apostrophecms/express/index.js (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using @apostrophecms/login-totp or any custom afterPasswordVerified login requirement. Version 4.28.0 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
apostrophenpm | < 4.28.0 | 4.28.0 |
Affected products
3cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*range: <4.28.0
- (no CPE)range: < 4.28.0
Patches
Vulnerability mechanics
References
3- github.com/apostrophecms/apostrophe/security/advisories/GHSA-v9xm-ffx2-7h35nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-v9xm-ffx2-7h35ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-32730ghsaADVISORY
News mentions
0No linked articles in our index yet.