CVE-2026-113648

3.1 Faible

Publiée le 20/10/2026 à 19:17 · Modifiée le 20/10/2026 à 21:53 · Analyse NVD reportée · Source : security-advisories@github.com

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.

Traduire en français

Produits concernés

apostrophecms apostrophe
@apostrophecms import-export

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.1 Faible	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-306
CWE-862

Références

https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rw26-wwfc-9wvm

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories