Skip to content
fr Sign in
6.5 Medium

CVE-2026-113649 ApostropheCMS is an open-source Node.js content management system

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove published variants without the normal publish permission and lifecycle checks. This issue is fixed in import-export 3.7.1 and ApostropheCMS 4.34.0.

Affected products and versions

Product Affected versions Fixed in
apostrophe 4.34 earliest → < 4.34.0 4.34.0
import-export 3.7 earliest → < 3.7.1 3.7.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of apostrophe

The 51 CVEs of apostrophe →
CVE-2026-113711 ApostropheCMS is an open-source Node.js content management system 7.5 High CVE-2026-113710 ApostropheCMS is an open-source Node.js content management system 5.9 Medium CVE-2026-113671 ApostropheCMS is an open-source Node.js content management system 4.3 Medium CVE-2026-113670 ApostropheCMS is an open-source Node.js content management system 5.3 Medium
Track this CVE