CVE-2021-25979

Apostrophe - Insufficient Session Expiration

State: Published
Severity: 9.8 Critical
Published: Nov 8, 2021
Updated: Apr 30, 2025
Reserved: Jan 22, 2021

Description

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Mend

Weaknesses

CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
ApostropheApostrophe	3.3.1 and earlierAffected 2.63.0 to before unspecifiedAffected

References

https://github.com/apostrophecms/apostrophe/commit/c211b211f9f4303a77a307cf41aac9b4ef8d2c7c

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.