CVE-2026-113649

6.5 Moyenne

Publiée le 20/10/2026 à 19:17 · Modifiée le 20/10/2026 à 21:53 · Analyse NVD reportée · Source : security-advisories@github.com

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove published variants without the normal publish permission and lifecycle checks. This issue is fixed in import-export 3.7.1 and ApostropheCMS 4.34.0.

Traduire en français

Produits concernés

apostrophecms apostrophe
@apostrophecms import-export

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N`

Faiblesses (CWE)

CWE-862

Références

https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1
https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-5m22-7pfq-vp65

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories