Skip to content
fr Sign in
7.1 High

CVE-2026-113666 ApostropheCMS is an open-source Node.js content management system

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.

Affected products and versions

Product Affected versions Fixed in
apostrophe 4.33 earliest → < 4.33.0 4.33.0
db-connect 1.1 earliest → < 1.1.0 1.1.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of apostrophe

The 51 CVEs of apostrophe →
CVE-2026-113711 ApostropheCMS is an open-source Node.js content management system 7.5 High CVE-2026-113710 ApostropheCMS is an open-source Node.js content management system 5.9 Medium CVE-2026-113671 ApostropheCMS is an open-source Node.js content management system 4.3 Medium CVE-2026-113670 ApostropheCMS is an open-source Node.js content management system 5.3 Medium
Track this CVE