Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-113669 · GHSA-hhvr-8m24-qqr3

ApostropheCMS: Cross-domain session token in URL confers session takeover

Risk score
42/100
CVSS
5.3 v4.0
Exploit chance (30 days)
0.3%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first u…
Affected
apostrophe (npm) < 4.33.0; @apostrophecms/passport-bridge (npm) < 1.6.1
Fix
Upgrade apostrophe to 4.33.0; @apostrophecms/passport-bridge to 1.6.1 or later.
Exploitation
No known exploitation

Story map

Story map: apostropheTHE FLAWSTHE FIXCVE-2026-113669ApostropheCMS: Cross-domainsession token in URL conferssession takeoverCVSS 5.3 · EPSS 0%CVE-2026-113711ApostropheCMS:Unauthenticated resourceexhaustion via pre-auth…CVSS 7.5 · EPSS 1%CVE-2026-113658ApostropheCMS:Unauthenticated CSV importrequests leave rejected…CVSS 7.5 · EPSS 1%CVE-2026-113653ApostropheCMS: The generalpublic can access@apostrophecms/user…CVSS 6.9 · EPSS 0%Upgrade apostrophe4.33.0or later on your release lineWho is exposed{'products': ['ApostropheCMS'],'packages': [{'ecosystem':'npm', 'name': 'apostrophe','vulnerable': '< 4.33.0','patched': '4.33.0'}…AMBER · PATCH THIS WEEKapostropheApostropheCMS has avulnerability that allowsunauthenticated requests toperform upload initialization,chunk storage, and temporaryprocessing, leading to resourceexhaustion. An attacker could…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-598 (CWE-598)1 other warning in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

apostrophe: Amber, patch this week. ApostropheCMS has a vulnerability that allows unauthenticated requests to perform upload initialization, chunk storage, and temporary processing, leading to resource exhaustion. An attacker could exploit this to exhaust system resources.

The flaws

  • CVE-2026-113669: ApostropheCMS: Cross-domain session token in URL confers session takeover (CVSS 5.3 · EPSS 0%)
  • CVE-2026-113711: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export (CVSS 7.5 · EPSS 1%)
  • CVE-2026-113658: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory (CVSS 7.5 · EPSS 1%)
  • CVE-2026-113653: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) (CVSS 6.9 · EPSS 0%)

The fix

Upgrade apostrophe: 4.33.0 or later on your release line

Who is exposed: {'products': ['ApostropheCMS'], 'packages': [{'ecosystem': 'npm', 'name': 'apostrophe', 'vulnerable': '< 4.33.0', 'patched': '4.33.0'}, {'ecosystem': 'npm', 'name': '@apostrophecms/import-export', 'vulnerable': '< 3.7.0', 'patched': '3.7.0'}]}

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
apostrophenpm< 4.33.04.33.0
@apostrophecms/passport-bridgenpm< 1.6.11.6.1

References

Original description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This issue is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.

Last activity 20 Oct 2026. Patch Forecast updates every hour.