Weak Password Change Mechanism in ApostropheCMS Affected by Security Flaw

CVE-2026-113710

What is CVE-2026-113710?

ApostropheCMS, an open-source Node.js content management system, has a vulnerability in its self-service password-change mechanism. Up to version 4.33.0, the system verifies the current password but fails to implement protective measures such as throttling, delaying, or locking out repeated attempts. This allows an authenticated attacker to make unlimited guesses for the current password without facing any rate limits or lockout barriers, making them susceptible to brute force attacks. The issue has been addressed in version 4.33.0 to enhance security measures.

References