CVE-2026-113652: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in apostrophecms apostrophe

CVE-2026-113652 describes an information exposure vulnerability in ApostropheCMS, an open-source Node.js CMS. Specifically, in versions >=1.25.0 and <1.28.0, when using the uploadfs Azure backend with SAS tokens enabled (sas: true), the createContainer() function constructs the BlobServiceClient from a URL containing the full SAS token query string. The Azure SDK v12 clients inherit this query string, resulting in the SAS token being leaked in every public attachment URL. This exposure could allow unauthorized actors to access Azure storage resources with the permissions granted by the leaked SAS token. The vulnerability is resolved in version 1.28.0.

The exposure of an account-level SAS token in public URLs can lead to unauthorized access to Azure storage resources associated with the ApostropheCMS instance. The CVSS score of 5.6 (medium severity) reflects the network attack vector, high attack complexity, no privileges required, and impacts on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

A fix is available in ApostropheCMS version 1.28.0. Users should upgrade to version 1.28.0 or later to remediate this vulnerability. Since this is a self-hosted product, administrators must apply the update to their installations. No other mitigations are indicated by the vendor advisory.