Notification Module Vulnerability in ApostropheCMS by Apostrophe

CVE-2026-113665

What is CVE-2026-113665?

ApostropheCMS versions prior to 4.33.0 feature a security flaw in the notification module, which exposes PATCH and DELETE REST endpoints. These endpoints allow operations directly on the underlying MongoDB collection without proper authentication checks. This oversight means an unauthenticated attacker who has access to a valid notification ID can maliciously modify or permanently delete notifications belonging to other users. Apostrophe has addressed this issue in version 4.33.0, emphasizing the importance of securing endpoints against unauthorized access.

References