Authentication Bypass in ApostropheCMS Import-Export Module
CVE-2026-113648
3.1LOW
What is CVE-2026-113648?
ApostropheCMS, a popular open-source Node.js content management system, has a vulnerability in its import-export module prior to version 3.7.1. Specifically, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export lacks necessary authentication and authorization checks. This allows any client, including unauthenticated users who have accessed the site and obtained a CSRF cookie, to invoke the self.cleanExport(req) method directly. This vulnerability can lead to unauthorized data exports, making it imperative for users to upgrade to version 3.7.1 or later to secure their systems.
Affected Version(s)
apostrophe < 4.34.0
import-export < 3.7.1