CVE-2026-113665
ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
- State
- Published
- Severity
- 3.7 Low
- Published
- Oct 20, 2026
- Updated
- Oct 28, 2026
- Reserved
- Oct 20, 2026
Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N | GitHub_M |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
apostropheapostrophecms |
|
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrc
- https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
- https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
- https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.