Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-113653 · GHSA-xf6w-q65w-4f2w

ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)

Risk score
53/100
CVSS
6.9 v4.0
Exploit chance (30 days)
0.4%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related …
Affected
apostrophe (npm) < 4.33.0
Fix
Upgrade apostrophe to 4.33.0 or later.
Exploitation
No known exploitation

Story map

Story map: apostropheTHE FLAWSTHE FIXCVE-2026-113653ApostropheCMS: The generalpublic can access@apostrophecms/user…CVSS 6.9 · EPSS 0%CVE-2026-113711ApostropheCMS:Unauthenticated resourceexhaustion via pre-auth…CVSS 7.5 · EPSS 1%CVE-2026-113658ApostropheCMS:Unauthenticated CSV importrequests leave rejected…CVSS 7.5 · EPSS 1%CVE-2026-113659ApostropheCMS: Client-sidePrototype Pollution inapos.http.parseQuery leading…CVSS 6.1 · EPSS 0%Upgrade apostrophe4.33.0or later on your release lineWho is exposed{'products': ['ApostropheCMS'],'packages': [{'ecosystem':'npm', 'name': 'apostrophe','vulnerable': '< 4.33.0','patched': '4.33.0'}…AMBER · PATCH THIS WEEKapostropheApostropheCMS has avulnerability that allowsunauthenticated requests toperform upload initialization,chunk storage, and temporaryprocessing, leading to resourceexhaustion. An attacker could…Where it standsPublic proof of conceptCONNECTS TOSame weaknessIncorrect authorisation (CWE-863)335 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

apostrophe: Amber, patch this week. ApostropheCMS has a vulnerability that allows unauthenticated requests to perform upload initialization, chunk storage, and temporary processing, leading to resource exhaustion. An attacker could exploit this to exhaust system resources.

The flaws

  • CVE-2026-113653: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) (CVSS 6.9 · EPSS 0%)
  • CVE-2026-113711: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export (CVSS 7.5 · EPSS 1%)
  • CVE-2026-113658: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory (CVSS 7.5 · EPSS 1%)
  • CVE-2026-113659: ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users (CVSS 6.1 · EPSS 0%)

The fix

Upgrade apostrophe: 4.33.0 or later on your release line

Who is exposed: {'products': ['ApostropheCMS'], 'packages': [{'ecosystem': 'npm', 'name': 'apostrophe', 'vulnerable': '< 4.33.0', 'patched': '4.33.0'}, {'ecosystem': 'npm', 'name': '@apostrophecms/import-export', 'vulnerable': '< 3.7.0', 'patched': '3.7.0'}]}

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.9 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
apostrophenpm< 4.33.04.33.0

References

Original description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but relationships do not automatically publish full user objects and password hashes are stored separately and are not affected. This issue is fixed in version 4.33.0.

Last activity 20 Oct 2026. Patch Forecast updates every hour.