CVE-2026-113662: CWE-284: Improper Access Control in apostrophecms apostrophe

CVE-2026-113662 describes an improper access control vulnerability (CWE-284) in the import-export module of ApostropheCMS before version 3.7.0. An authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unintended existing document that the user has generic edit permission to modify. The findForEditing permission filter still applies, preventing permission-free overwrites of protected content. The vulnerability allows limited unauthorized modification of documents within the scope of the user's generic edit permissions. The issue is resolved in version 3.7.0 of the import-export module.

The vulnerability allows authenticated users with import access to modify documents they have generic edit permissions on in an unintended manner by manipulating update-key values during import. This can lead to unauthorized modification of content, but does not allow bypassing permission checks to overwrite arbitrary protected content. The impact is limited to integrity and availability aspects within the scope of the user's existing permissions.

Upgrade the ApostropheCMS import-export module to version 3.7.0 or later, where this vulnerability is fixed. No other specific mitigation is indicated. Since this is not a cloud service, users must apply the update themselves.