Timing Side-Channel Vulnerability in ApostropheCMS by Apostrophe

CVE-2026-33877

What is CVE-2026-33877?

ApostropheCMS, an open-source Node.js content management system, has a vulnerability in the password reset endpoint that permits unauthenticated enumeration of usernames and emails. This flaw arises because an artificial delay of two seconds is introduced when a user is not found, while valid users are processed without such delay, leading to significant differences in response times. The lack of rate limiting allows attackers to exploit this vulnerability for automated enumeration, potentially aiding in credential stuffing and phishing attacks. Only installations where the passwordReset option is explicitly enabled are susceptible, while the default setting is disabled. Users should upgrade to version 4.29.0 to mitigate this risk.

References