CVE-2026-45012 is an authenticated SSRF vulnerability in ApostropheCMS (Node.js CMS) affecting versions up to 4.29.0. The issue exists in the rich-text widget import flow where an authenticated user can manipulate the server to fetch attacker-controlled URLs during widget validation. This can lead to the server fetching arbitrary URLs, and if the response is compatible with images, the content can be stored and re-hosted by the CMS, enabling exfiltration of data from internal or external resources. As of the publication date, no official fix or patch is available.

An authenticated user with permission to submit or edit rich-text widget content can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests to attacker-controlled or internal URLs. This can lead to unauthorized data exfiltration if the response is image-compatible and persisted by the CMS. The vulnerability has a CVSS 3.1 score of 7.6 (high severity), indicating significant confidentiality impact, limited integrity impact, and limited availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is released, restrict authenticated user permissions to prevent untrusted users from submitting or editing rich-text widget content. Monitor for unusual server-side requests originating from the rich-text widget import flow. Avoid exposing sensitive internal resources accessible via SSRF.