CVE-2026-53609 is a prototype pollution vulnerability in ApostropheCMS (apostrophe) affecting versions up to and including 4.30.0. The function apos.util.set() improperly traverses dot-notation paths without sanitizing the __proto__ property, allowing an authenticated editor to write arbitrary values to Object.prototype using the $pullAll patch operator. This leads to a confirmed gadget in publicApiCheck() that bypasses authorization on all piece-type REST API endpoints for any unauthenticated requests thereafter, persisting for the lifetime of the Node.js process. No official fix or patch is available at the time of publication.

An authenticated editor can exploit this vulnerability to perform prototype pollution, which results in bypassing authorization controls on all piece-type REST API endpoints for subsequent unauthenticated requests. This compromises confidentiality, integrity, and availability of the affected system, as unauthorized access and partial control over API endpoints is possible. The vulnerability has a high CVSS score of 9.1, indicating critical severity.

As of the time of this report, no official patch or fix is available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, limit editor privileges to trusted users only and consider additional access controls or network-level restrictions to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.