Node.js Content Management System Vulnerability in ApostropheCMS by Apostrophe

CVE-2026-112956

What is CVE-2026-112956?

ApostropheCMS, an open-source Node.js content management system, contains a vulnerability in its import-export module prior to version 3.7.1. This issue arises due to the duplicate-import continuation process, which accepts client-controlled replacement choices without proper server-side validation or authorization of the target document. Consequently, a contributor with draft editing permissions can unintentionally replace published documents, crossing the publication boundary. This flaw has been addressed in version 3.7.1, which mitigates the risk by implementing necessary checks and constraints.

References