# cve.now: Apostrophecms

The newest entries naming Apostrophecms as an affected vendor (up to 200), of 56 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-113711](https://cve.now/CVE-2026-113711.md): ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export (CVSS 7.5)
- [CVE-2026-113710](https://cve.now/CVE-2026-113710.md): ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing (CVSS 5.9)
- [CVE-2026-113671](https://cve.now/CVE-2026-113671.md): ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF (CVSS 4.3)
- [CVE-2026-113669](https://cve.now/CVE-2026-113669.md): ApostropheCMS: Cross-domain session token in URL confers session takeover (CVSS 5.3)
- [CVE-2026-113667](https://cve.now/CVE-2026-113667.md): ApostropheCMS: CAPTCHA response token not URL-encoded (CVSS 5.3)
- [CVE-2026-113668](https://cve.now/CVE-2026-113668.md): ApostropheCMS: :\_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) (CVSS 5.3)
- [CVE-2026-113666](https://cve.now/CVE-2026-113666.md): ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service (CVSS 7.1)
- [CVE-2026-113665](https://cve.now/CVE-2026-113665.md): ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints (CVSS 3.7)
- [CVE-2026-113664](https://cve.now/CVE-2026-113664.md): ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test (CVSS 5.3)
- [CVE-2026-113662](https://cve.now/CVE-2026-113662.md): ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document (CVSS 5.4)
- [CVE-2026-113661](https://cve.now/CVE-2026-113661.md): ApostropheCMS: Incomplete CVE-2026-53606: \`meta http-equiv=refresh\` \`content\` still ships \`javascript:\` / \`data:\` URLs (CVSS 5.4)
- [CVE-2026-113660](https://cve.now/CVE-2026-113660.md): ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers (CVSS 4.3)
- [CVE-2026-113659](https://cve.now/CVE-2026-113659.md): ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users (CVSS 6.1)
- [CVE-2026-113658](https://cve.now/CVE-2026-113658.md): ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory (CVSS 7.5)
- [CVE-2026-113657](https://cve.now/CVE-2026-113657.md): ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) (CVSS 3.7)
- [CVE-2026-113656](https://cve.now/CVE-2026-113656.md): ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS (CVSS 5.3)
- [CVE-2026-113649](https://cve.now/CVE-2026-113649.md): ApostropheCMS: Import API bypasses publication roles for protected content (CVSS 6.5)
- [CVE-2026-113655](https://cve.now/CVE-2026-113655.md): ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization (CVSS 4.3)
- [CVE-2026-113654](https://cve.now/CVE-2026-113654.md): ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting \<noscript\> content render (CVSS 5.3)
- [CVE-2026-113653](https://cve.now/CVE-2026-113653.md): ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) (CVSS 6.9)
- [CVE-2026-113652](https://cve.now/CVE-2026-113652.md): ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true) (CVSS 5.6)
- [CVE-2026-113651](https://cve.now/CVE-2026-113651.md): ApostropheCMS: Path traversal in uploadfs (CVSS 3.3)
- [CVE-2026-113650](https://cve.now/CVE-2026-113650.md): ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) (CVSS 5.3)
- [CVE-2026-113648](https://cve.now/CVE-2026-113648.md): ApostropheCMS: Missing Authentication in \`cleanExport\` Route (CVSS 3.1)
- [CVE-2026-112958](https://cve.now/CVE-2026-112958.md): ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization (CVSS 5.4)
- [CVE-2026-112957](https://cve.now/CVE-2026-112957.md): ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users (CVSS 4.3)
- [CVE-2026-112956](https://cve.now/CVE-2026-112956.md): ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content (CVSS 6.5)
- [CVE-2026-112955](https://cve.now/CVE-2026-112955.md): ApostropheCMS: Import archives can exhaust server storage and deny service (CVSS 6.5)
- [CVE-2026-112954](https://cve.now/CVE-2026-112954.md): ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API (CVSS 5.3)
- [CVE-2026-112953](https://cve.now/CVE-2026-112953.md): ApostropheCMS: Exposure of Sensitive Information via predictable export filenames (CVSS 6.0)
- [CVE-2026-112952](https://cve.now/CVE-2026-112952.md): ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user (CVSS 4.3)
- [CVE-2026-112951](https://cve.now/CVE-2026-112951.md): ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix (CVSS 5.4)
- [CVE-2026-110904](https://cve.now/CVE-2026-110904.md): ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 c (CVSS 5.3)
- [CVE-2026-84371](https://cve.now/CVE-2026-84371.md): ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass (CVSS 5.4)
- [CVE-2026-71553](https://cve.now/CVE-2026-71553.md): ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS (CVSS 7.1)
- [CVE-2026-63667](https://cve.now/CVE-2026-63667.md): ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal (CVSS 6.5)
- [CVE-2026-63670](https://cve.now/CVE-2026-63670.md): ApostropheCMS: Mutation-XSS / allowedTags bypass via literal \`\</textarea/\>\` solidus close (CVSS 6.1)
- [CVE-2026-63669](https://cve.now/CVE-2026-63669.md): ApostropheCMS: Missing destination-parent authorization in page \`move()\` allows a low-privileged editor to move and re-rank pages inside a restricted subtree (CVSS 6.5)
- [CVE-2026-53609](https://cve.now/CVE-2026-53609.md): Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass (CVSS 9.1)
- [CVE-2026-53608](https://cve.now/CVE-2026-53608.md): @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag (CVSS 8.7)
- [CVE-2026-53607](https://cve.now/CVE-2026-53607.md): @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header (CVSS 3.7)
- [CVE-2026-53606](https://cve.now/CVE-2026-53606.md): sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes (CVSS 5.4)
- [CVE-2026-45014](https://cve.now/CVE-2026-45014.md): Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltip (CVSS 5.3)
- [CVE-2026-45013](https://cve.now/CVE-2026-45013.md): Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation (CVSS 8.1)
- [CVE-2026-45012](https://cve.now/CVE-2026-45012.md): Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget (CVSS 7.6)
- [CVE-2026-45011](https://cve.now/CVE-2026-45011.md): Apostrophe has stored XSS via javascript: URL in Image Widget Link (CVSS 7.3)
- [CVE-2026-44990](https://cve.now/CVE-2026-44990.md): Apostrophe has default XSS via \`xmp\` raw-text passthrough in \`sanitize-html\` (CVSS 9.3)
- [CVE-2026-42853](https://cve.now/CVE-2026-42853.md): @apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input (CVSS 6.5)
- [CVE-2026-40186](https://cve.now/CVE-2026-40186.md): ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements (CVSS 6.1)
- [CVE-2026-39857](https://cve.now/CVE-2026-39857.md): Information Disclosure via \`choices\`/\`counts\` Query Parameters Bypassing publicApiProjection Field Restrictions (CVSS 5.3)
- [CVE-2026-35569](https://cve.now/CVE-2026-35569.md): ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS (CVSS 8.7)
- [CVE-2026-33889](https://cve.now/CVE-2026-33889.md): ApostropheCMS: Stored XSS via CSS Custom Property Injection in \`@apostrophecms/color-field\` Escaping Style Tag Context (CVSS 5.4)
- [CVE-2026-33888](https://cve.now/CVE-2026-33888.md): ApostropheCMS: publicApiProjection Bypass via \`project\` Query Builder in Piece-Type REST API (CVSS 5.3)
- [CVE-2026-33877](https://cve.now/CVE-2026-33877.md): ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint (CVSS 3.7)
- [CVE-2026-32731](https://cve.now/CVE-2026-32731.md): ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction (CVSS 10.0)
- [CVE-2026-32730](https://cve.now/CVE-2026-32730.md): ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware (CVSS 8.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/apostrophecms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.