CVE-2026-113660

Prior to ApostropheCMS 4.33.0 and import-export 3.7.0, import routes invoke bigUploadMiddleware without an early authorize callback. Unauthenticated requests can perform upload initialization, chunk storage, temporary processing and attacker-declared cleanup work before the later user check rejects the import.

ApostropheCMS prior to 4.33.0 has a self-service password-change endpoint that verifies the current password but does not use the login module's failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. This is fixed in version 4.33.0.

ApostropheCMS prior to 4.33.0 has its core page REST API read full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by _id/slug. This is fixed in version 4.33.0.

ApostropheCMS prior to 4.33.0 has a REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) that does not apply the publicApiCheckAsync gate enforced by other read routes. An unauthenticated caller can query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read API is otherwise supposed to gate. This is fixed in version 4.33.0.

In the CAPTCHA integrations (Form, login-recaptcha, login-hcaptcha) for ApostropheCMS, the user-supplied response token is interpolated unencoded into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated forms or login flows. Automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure has not been established.

Prior to db-connect 1.1.0 and ApostropheCMS 4.33.0, an account with view-draft access can submit a projection exclusion path that traverses a constructor prototype chain to a shared prototype member when a SQLite, PostgreSQL or multipostgres adapter is used. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected.

In the import-export module of ApostropheCMS before 3.7.0, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content.

Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibling ranks without create authorization on that parent. The bypass is limited to sibling ordering rather than arbitrary content modification, confidentiality loss, or creation of the restricted nesting.

Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but password hashes are stored separately and are not affected.

Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered.