Remote Code Execution Flaw in ApostropheCMS Affects Node.js Content Management System

CVE-2026-45013

What is CVE-2026-45013?

ApostropheCMS, an open-source Node.js content management system, is vulnerable due to its password reset flow that improperly handles reset URL creation. This vulnerability allows an unauthenticated attacker, who knows a victim's email address, to exploit the application by sending a malicious password reset request. The resultant email contains a reset link directed to the attacker's domain instead of a legitimate one. Clicking this link permits the attacker to obtain a valid reset token, potentially granting them full control over the victim's account. Currently, no patched versions are available.

References