CVE-2026-113648: CWE-306: Missing Authentication for Critical Function in apostrophecms apostrophe
Description
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.
CVSS v3.1
Score 3.1low
Affected software
apostrophecms
apostrophe
@apostrophecms
import-export
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-113648 describes a missing authentication vulnerability (CWE-306) in the ApostropheCMS import-export module before version 3.7.1. Specifically, the POST /api/v1/@apostrophecms/import-export/clean-export endpoint does not enforce authentication or authorization, enabling any client, including unauthenticated anonymous users who have a standard CSRF cookie, to invoke the cleanExport method. This could lead to unauthorized triggering of export cleaning functionality. The vulnerability is resolved in version 3.7.1 of the module.
Potential Impact
The vulnerability allows unauthorized users to invoke a critical function (cleanExport) without authentication or authorization. According to the CVSS vector, the impact on confidentiality is none, integrity is low, and availability is none. This indicates limited impact, primarily a low integrity impact due to unauthorized function invocation. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade the @apostrophecms/import-export module to version 3.7.1 or later, where the authentication and authorization checks for the affected API endpoint have been implemented. No other specific mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-20T14:27:46.640Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad7948a2cdf04f65641f464
Added to database: 10/20/2026, 16:19:22 UTC
Last enriched: 10/20/2026, 16:33:23 UTC
Last updated: 10/20/2026, 19:06:08 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.