CVE-2026-113665

ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.

Affected

apostrophecms · apostrophe

CVSS v3.1 GITHUB

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.35% chance of exploitation in the next 30 days, 28th percentile

Published

2026-10-20

Updated

2026-10-28

Proof-of-concept exploits (1)

• advisories/GHSA-vwwx-px9w-crrcsnapshot

CVE references

• apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ceREFERENCE
• apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350REFERENCE
• apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0REFERENCE
• apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrcREFERENCE

References

• CVE Record
• NVD entry