Vulnerability Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25
- https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25d
- https://github.com/apostrophecms/apostrophe/releases/tag/[email protected]
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-c
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-c
FAQ
What is CVE-2026-113665?
CVE-2026-113665 is a vulnerability with a CVSS score of 3.7 (LOW). ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying M...
How severe is CVE-2026-113665?
CVE-2026-113665 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-113665?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.