CVE-2026-110904

ApostropheCMS is a Node.js content management system that, in versions up to 4.30.0, allows unauthorized modifications to object prototypes by authenticated editors. The use of the `$pullAll` operator enables writing arbitrary values to `Object.prototype`, leading to authorization bypass on all REST API endpoints.

ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.

ApostropheCMS before 4.32.0 has a vulnerability in the page module's move() operation that fails to enforce the destination parent's _create permission for ordinary moves, allowing an authenticated editor or contributor to move a controlled page into a restricted subtree and re-rank protected sibling pages.

ApostropheCMS before 3.6.2 has a vulnerability in the import-export module where the attachment source path is constructed from attacker-controlled _id, name, and extension fields without ensuring the path remains under the extracted attachments directory, allowing an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL.

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting via unsanitized user display name in draft version tooltip.

ApostropheCMS is a Node.js content management system that in versions up to 4.29.0 has a vulnerability in the password reset process. This vulnerability allows an attacker to send a crafted reset request that results in a reset link being sent to the attacker's domain.

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in the rich-text widget import flow, allowing an attacker to force the server to fetch attacker-controlled URLs.

ApostropheCMS version 4.29.0 has a stored XSS vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload, allowing a malicious widget to be published on the site.