CVE-2026-113710: CWE-307: Improper Restriction of Excessive Authentication Attempts in apostrophecms apostrophe
Description
ApostropheCMS versions prior to 4.33.0 have an improper restriction of excessive authentication attempts vulnerability in the self-service password-change endpoint. This endpoint verifies the current password but does not enforce the login module's failed-attempt counter, throttle, delay, or lockout mechanisms. As a result, an authenticated attacker can repeatedly guess the current password without triggering lockout or throttling. The issue is fixed in version 4.33.0.
CVSS v3.1
Score 5.9medium
Affected software
apostrophecms
apostrophe
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-113710 describes a vulnerability in ApostropheCMS, an open-source Node.js content management system. Before version 4.33.0, the self-service password-change endpoint allows an authenticated user to submit repeated guesses for the current password without triggering the login module's protections such as failed-attempt counters, throttling, delays, or lockouts. This improper restriction of excessive authentication attempts (CWE-307) can lead to credential compromise. The vulnerability is addressed in ApostropheCMS version 4.33.0.
Potential Impact
An attacker with a valid authenticated session can perform unlimited password guessing attempts on the password-change endpoint without being locked out or delayed. This increases the risk of successful password compromise, potentially leading to unauthorized account access and full confidentiality and integrity impact on the affected account. Availability is not impacted.
Mitigation Recommendations
Upgrade ApostropheCMS to version 4.33.0 or later, where this vulnerability is fixed. Prior versions do not enforce throttling or lockout on the password-change endpoint, so patching is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-20T16:03:14.862Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad7ad552cdf04f6564c9cfa
Added to database: 10/20/2026, 18:05:09 UTC
Last enriched: 10/20/2026, 18:18:25 UTC
Last updated: 10/20/2026, 19:06:08 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.