CVE-2026-113666 in Apostrophe
Summary
by MITRE • 10/20/2026
ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
ApostropheCMS is a widely used open-source content management system built on Node.js, designed to provide flexible tools for managing digital content. A critical security vulnerability was identified within the database connectivity layer of this platform, specifically affecting versions prior to 1.1.0 of the db-connect module and version 4.33.0 of ApostropheCMS itself. This flaw represents a significant risk to data integrity and system availability when specific database adapters are utilized in conjunction with particular user permissions. The vulnerability stems from how the application handles projection exclusion paths during document retrieval operations, allowing for unintended side effects that extend beyond the scope of individual queries into the broader runtime environment.
The technical root cause lies in the handling of MongoDB-style query projections within non-MongoDB database adapters such as SQLite, PostgreSQL, and multipostgres. When a user with view-draft access submits a request containing a projection exclusion path, the application processes this input through an internal helper function named unsetNestedField. Due to insufficient validation or sanitization of the provided paths, attackers can craft malicious inputs that traverse the JavaScript constructor prototype chain. This traversal allows the attacker to target shared prototype members rather than just instance-specific data fields. In Node.js applications, objects often share prototypes to conserve memory and manage inheritance; modifying these shared structures affects all instances derived from that prototype within the current process context.
The operational impact of this vulnerability is severe due to its persistent nature. By successfully exploiting the prototype chain traversal, an attacker can delete or corrupt shared runtime members via the unsetNestedField function. This results in a denial-of-service condition for other users and processes sharing the same Node.js instance, as critical application state becomes corrupted. Unlike transient errors that might be recovered from by restarting a single request handler, this corruption persists across subsequent operations until the process is restarted or the memory is otherwise cleared. Consequently, system availability is compromised, and data integrity cannot be guaranteed for any user interacting with the affected database adapters during the window of exploitation.
Access requirements for exploiting this vulnerability are relatively low but specific. Any account possessing view-draft access can initiate the attack. In ApostropheCMS, every editing role inherently includes view-draft permissions, meaning that authenticated users with editorial responsibilities can exploit this flaw. Furthermore, if the guestApiAccess setting is enabled, the prerequisite broadens to include any logged-in account, significantly expanding the potential attacker pool from privileged editors to general registered users. This accessibility makes the vulnerability particularly dangerous in multi-tenant or public-facing deployments where user registration is common and access controls may not be strictly enforced at the API level for draft viewing capabilities.
The default MongoDB adapter used by ApostropheCMS is not affected by this issue, as its internal query handling mechanisms differ from those of the SQL-based adapters. The vulnerability is isolated to implementations that rely on the specific projection exclusion logic vulnerable to prototype pollution in SQLite, PostgreSQL, and multipostgres environments. This distinction highlights the importance of understanding how different database drivers interact with application-level security controls, as a flaw in one adapter does not necessarily imply safety across all supported databases within the same framework version.
Mitigation strategies primarily involve upgrading to patched versions immediately. Administrators must update db-connect to version 1.1.0 or later and ApostropheCMS to version 4.33.0 or later, where these issues have been resolved through improved input validation and safer handling of projection paths. For organizations unable to upgrade immediately due to compatibility constraints, implementing strict access controls is essential. This includes restricting view-draft permissions only to trusted administrative accounts rather than all editing roles if possible, and disabling guestApiAccess unless absolutely necessary for business operations. Additionally, deploying a Web Application Firewall with rules capable of detecting prototype pollution patterns in query parameters may provide an additional layer of defense against exploitation attempts while permanent fixes are applied.
From a classification perspective, this vulnerability aligns with CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes, commonly known as Prototype Pollution. It also relates to CWE-787 Out-of-bounds Write if the memory corruption leads to buffer overflows or similar low-level issues, though in Node.js contexts it typically manifests as logical state corruption. In terms of attack vectors, this falls under ATT&CK technique T1059 Command and Scripting Interpreter via JavaScript exploitation, specifically focusing on manipulating object properties to achieve unauthorized side effects. The persistence aspect of the vulnerability also touches upon availability impacts described in various cyber kill chain models, emphasizing that integrity violations can directly lead to service disruption.
Security teams should audit their ApostropheCMS deployments for these specific version numbers and adapter configurations. Regular security assessments should include testing for prototype pollution vulnerabilities, especially when user-supplied data influences object property manipulation or query construction. Ensuring that database adapters are up-to-date with the latest patches from their maintainers is crucial, as framework-level fixes often depend on underlying library updates to address low-level handling errors. Continuous monitoring of application logs for unusual patterns in document retrieval requests can also help detect attempted exploitation before significant damage occurs.