Vulnerability in ApostropheCMS Import-Export Module and Core Functionality

CVE-2026-113649

What is CVE-2026-113649?

ApostropheCMS, an open-source Node.js content management system, has a vulnerability that allows editors to import specific content types without proper permissions. This flaw enables users with insufficient roles to manipulate published content variants without adhering to necessary publishing permissions and lifecycle checks. The vulnerability affects versions prior to 3.7.1 of the import-export module and 4.34.0 of the core application. It has been addressed in the mentioned releases, ensuring that import write functionality now respects the established permission and lifecycle rules.

References