CVE-2026-113662 in Apostrophe
Summary
by MITRE • 10/20/2026
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits the candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content. This issue is fixed in version 3.7.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
ApostropheCMS represents a widely utilized open-source content management system built on Node.js, designed to facilitate flexible website creation and maintenance. Within its architecture, the import-export module serves as a critical component for data migration and backup restoration, allowing administrators and authorized users to transfer structured content between environments or restore previous states of the site's database. This functionality relies heavily on robust permission checks to ensure that only appropriate actions are performed on specific document types. The vulnerability identified in versions prior to 3.7.0 resides within this import-export mechanism, specifically concerning how update keys are processed during data ingestion operations.
The core technical flaw stems from improper validation of the update-key value supplied by an authenticated user who possesses import access for a target content type. In standard database query construction, particularly in NoSQL environments like MongoDB which ApostropheCMS often utilizes, the structure of query operators and object literals determines how documents are matched and updated. The vulnerability allows an attacker to inject specific objects or operators as part of the update-key value. This injection causes the underlying import query to match against existing documents that were not explicitly targeted by the intended import operation but for which the user holds generic edit permissions. Consequently, the system fails to restrict the scope of the update strictly to the new data being imported, instead applying modifications based on broader matching criteria enabled by the maliciously crafted input.
From an operational impact perspective, this vulnerability enables a form of unauthorized modification known as an insecure direct object reference or related access control flaw. While the normal findForEditing permission filter remains in place and prevents users from overwriting arbitrary protected content without any permissions, it does not fully mitigate the risk for documents where the user already has generic edit rights. An attacker can leverage this to modify existing records that they are permitted to edit but should not be able to alter via an import operation intended for a different purpose or context. This could lead to data integrity issues, such as altering metadata, changing content structures in unintended ways, or potentially escalating privileges if the modified fields influence access control logic elsewhere in the application. The impact is significant because it bypasses the logical boundaries of the import feature, turning a routine administrative task into a vector for unauthorized state changes within the CMS database.
This issue aligns with CWE-284 Improper Access Control and CWE-915 Improper Modification of Object Attributes, as it involves an authenticated user exploiting insufficient validation to modify object attributes beyond their intended scope. In terms of threat modeling, this behavior corresponds to ATT&CK technique T1078 Valid Accounts, where the attacker uses legitimate credentials but abuses specific application logic rather than stealing or creating new accounts. The exploitation requires authentication and a specific role with import capabilities, making it an insider threat scenario or one resulting from compromised administrative credentials.
The vulnerability has been addressed in version 3.7.0 of ApostropheCMS through enhanced validation mechanisms for the update-key values within the import-export module. To mitigate this risk, organizations using older versions must upgrade to version 3.7.0 or later immediately upon availability. For environments where an immediate upgrade is not feasible due to compatibility constraints, administrators should enforce strict role-based access control policies, ensuring that only highly trusted individuals have import permissions for sensitive content types. Additionally, implementing input validation at the application layer to reject non-standard object structures in update keys can provide a temporary defensive measure until the patch is applied. Regular auditing of user roles and monitoring for unusual patterns in data modification logs are also recommended practices to detect potential exploitation attempts early.