Threat Intelligence Database

ApostropheCMS versions prior to 4.34.0 and import-export module versions prior to 3.7.1 contain a missing authorization vulnerability. An editor with import permissions but without the stronger publication role can improperly create, replace, or remove published content variants without the usual publish permission and lifecycle checks. This issue allows unauthorized modification of published content variants. The vulnerability has a medium severity rating and a CVSS score of 6.5. It is fixed in import-export 3.7.1 and ApostropheCMS 4.34.0.

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.