CVE-2026-45012 is an authenticated SSRF vulnerability in ApostropheCMS (Node.js CMS) affecting versions up to 4.29.0. The issue exists in the rich-text widget import flow, where an authenticated user can manipulate the server to fetch arbitrary URLs during widget validation. This can lead to the server retrieving attacker-controlled content. For image-compatible responses, the fetched content may be stored and re-hosted by the CMS, allowing attackers to exfiltrate data from internal or external resources accessible to the server. As of the publication date, no official fix or patch has been released.

Successful exploitation allows an authenticated user with permission to submit or edit rich-text widget content to induce the server to make arbitrary HTTP requests to attacker-controlled or internal URLs. This can lead to unauthorized data retrieval or exfiltration if the response is image-compatible and persisted by the CMS. The vulnerability impacts confidentiality, integrity, and availability to a limited extent, with a high severity rating (CVSS 7.6). There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should restrict authenticated user permissions to trusted individuals only and monitor for suspicious activity related to rich-text widget content submissions. Follow vendor advisories for updates regarding patches or mitigations. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.