Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-113710 · GHSA-653j-g8j7-gh54

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

Risk score
46/100
CVSS
5.9 v3.1
Exploit chance (30 days)
0.3%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeat…
Affected
apostrophe (npm) < 4.33.0
Fix
Upgrade apostrophe to 4.33.0 or later.
Exploitation
No known exploitation

Story map

Story map: apostropheTHE FLAWSTHE FIXCVE-2026-113710ApostropheCMS: No AttemptThrottling on AuthenticatedPassword-Change Endpoint…CVSS 5.9 · EPSS 0%CVE-2026-113711ApostropheCMS:Unauthenticated resourceexhaustion via pre-auth…CVSS 7.5 · EPSS 1%CVE-2026-113658ApostropheCMS:Unauthenticated CSV importrequests leave rejected…CVSS 7.5 · EPSS 1%CVE-2026-113653ApostropheCMS: The generalpublic can access@apostrophecms/user…CVSS 6.9 · EPSS 0%Upgrade apostrophe4.33.0or later on your release lineWho is exposed{'products': ['ApostropheCMS'],'packages': [{'ecosystem':'npm', 'name': 'apostrophe','vulnerable': '< 4.33.0','patched': '4.33.0'}…AMBER · PATCH THIS WEEKapostropheApostropheCMS has avulnerability that allowsunauthenticated requests toperform upload initialization,chunk storage, and temporaryprocessing, leading to resourceexhaustion. An attacker could…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-307 (CWE-307)29 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

apostrophe: Amber, patch this week. ApostropheCMS has a vulnerability that allows unauthenticated requests to perform upload initialization, chunk storage, and temporary processing, leading to resource exhaustion. An attacker could exploit this to exhaust system resources.

The flaws

  • CVE-2026-113710: ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing (CVSS 5.9 · EPSS 0%)
  • CVE-2026-113711: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export (CVSS 7.5 · EPSS 1%)
  • CVE-2026-113658: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory (CVSS 7.5 · EPSS 1%)
  • CVE-2026-113653: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) (CVSS 6.9 · EPSS 0%)

The fix

Upgrade apostrophe: 4.33.0 or later on your release line

Who is exposed: {'products': ['ApostropheCMS'], 'packages': [{'ecosystem': 'npm', 'name': 'apostrophe', 'vulnerable': '< 4.33.0', 'patched': '4.33.0'}, {'ecosystem': 'npm', 'name': '@apostrophecms/import-export', 'vulnerable': '< 3.7.0', 'patched': '3.7.0'}]}

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.9 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
apostrophenpm< 4.33.04.33.0

References

Original description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. This issue is fixed in version 4.33.0.

Last activity 20 Oct 2026. Patch Forecast updates every hour.