7.1
Élevée
CVE-2026-113666 ApostropheCMS is an open-source Node.js content management system
Description
ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| apostrophe 4.33 | premières → < 4.33.0 | 4.33.0 |
| db-connect 1.1 | premières → < 1.1.0 | 1.1.0 |
Autres CVE de apostrophe
Les 51 CVE de apostrophe →
CVE-2026-113711
ApostropheCMS is an open-source Node.js content management system
7.5
Élevée
CVE-2026-113710
ApostropheCMS is an open-source Node.js content management system
5.9
Moyenne
CVE-2026-113671
ApostropheCMS is an open-source Node.js content management system
4.3
Moyenne
CVE-2026-113670
ApostropheCMS is an open-source Node.js content management system
5.3
Moyenne