CVE-2026-113649: CWE-862: Missing Authorization in apostrophecms apostrophe
Description
ApostropheCMS versions prior to 4.34.0 and import-export module versions prior to 3.7.1 contain a missing authorization vulnerability. An editor with import permissions but without the stronger publication role can improperly create, replace, or remove published content variants without the usual publish permission and lifecycle checks. This issue allows unauthorized modification of published content variants. The vulnerability has a medium severity rating and a CVSS score of 6.5. It is fixed in import-export 3.7.1 and ApostropheCMS 4.34.0.
CVSS v3.1
Score 6.5medium
Affected software
apostrophecms
apostrophe
@apostrophecms
import-export
pkg:github/apostrophecms/apostrophepkg:github/apostrophecms/import-exportRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-113649 describes a missing authorization vulnerability (CWE-862) in ApostropheCMS, an open-source Node.js content management system. Before versions 4.34.0 of core ApostropheCMS and 3.7.1 of the import-export module, an editor who can import an enabled content type but lacks the stronger publication role can cause import write helpers to create, replace, or remove published variants without the normal publish permission and lifecycle checks. This bypass of authorization controls allows unauthorized modification of published content variants. The vulnerability is addressed by updating to import-export 3.7.1 and ApostropheCMS 4.34.0.
Potential Impact
The vulnerability allows an editor with import permissions but without the required publish role to modify published content variants without proper authorization checks. This can lead to unauthorized changes to published content, potentially impacting content integrity and trustworthiness. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild.
Mitigation Recommendations
A fix is available. Users should upgrade to import-export module version 3.7.1 and ApostropheCMS core version 4.34.0 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-20T14:27:46.640Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad79b8c2cdf04f65643a7af
Added to database: 10/20/2026, 16:49:16 UTC
Last enriched: 10/20/2026, 17:03:52 UTC
Last updated: 10/20/2026, 19:06:08 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.