CVE-2026-113665: CWE-639: Authorization Bypass Through User-Controlled Key in apostrophecms apostrophe
Description
ApostropheCMS versions prior to 4.33.0 have a vulnerability in the notification module where PATCH and DELETE REST endpoints do not verify authentication or ownership of notifications. This allows an unauthenticated attacker with a valid notification ID to modify or delete notifications belonging to other users. The issue is fixed in version 4.33.0.
CVSS v3.1
Score 3.7low
Affected software
apostrophecms
apostrophe
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ApostropheCMS, an open-source Node.js CMS, contains an authorization bypass vulnerability (CWE-639) in its notification module before version 4.33.0. The PATCH and DELETE REST endpoints operate directly on the MongoDB collection without verifying if the requester is authenticated or owns the notification resource. Consequently, an unauthenticated attacker who knows a valid notification ID can alter or delete notifications of other users. This flaw is addressed in version 4.33.0.
Potential Impact
The vulnerability allows unauthorized modification or deletion of user notifications by unauthenticated attackers who possess valid notification IDs. While it does not impact confidentiality or availability, it can lead to integrity loss of notification data. The CVSS score is 3.7 (low severity), reflecting limited impact and higher attack complexity.
Mitigation Recommendations
Upgrade ApostropheCMS to version 4.33.0 or later, where the authorization checks for notification PATCH and DELETE endpoints have been implemented. No other mitigation is specified or required as the fix is official and available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-20T14:27:46.641Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad7a6132cdf04f65647bf40
Added to database: 10/20/2026, 17:34:11 UTC
Last enriched: 10/20/2026, 17:48:25 UTC
Last updated: 10/20/2026, 19:06:08 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.