# CVE-2021-25979: Apostrophe CMS insufficient session expiration

Source: https://junglewise.ai/threats/cve-2021-25979-apostrophe-cms-insufficient-session-expiration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-11-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-25979 · Severity: low · CVSS 3.1 · Published 2021-11-10

Apostrophe CMS is a Node.js-based content management system used to build and manage websites. A flaw in session management allows unauthenticated attackers to hijack the sessions of users who have recently logged in, potentially gaining unauthorized access to administrative functions and website content. This could allow an attacker to take control of the site or access sensitive data without needing valid credentials.

Technologies: [Apostrophe CMS](https://junglewise.ai/threats/technologies/apostrophe-cms), [apostrophe (npm)](https://junglewise.ai/threats/technologies/apostrophe). Vendors: [Apostrophe](https://junglewise.ai/threats/vendors/apostrophe), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-25979 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-25979 being exploited in the wild.

**How severe is CVE-2021-25979?** Low severity, with a CVSS score of 3.1, published 10 November 2021.

**Which products and versions are affected?** Apostrophe CMS 2.63.0 to 3.3.1; apostrophe (npm) SEMVER:introduced=2.63.0,fixed=3.4.0.

**Is there a fix for CVE-2021-25979?** Yes. apostrophe (npm): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-25979 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-25979?** Check whether you run Apostrophe CMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apostrophe (npm): upgrade to 3.4.0 or later

  ```sh
  npm install apostrophe@3.4.0
  ```


## Technical details

Apostrophe CMS versions 2.63.0 through 3.3.1 fail to properly expire user sessions after logout or account inactivity, violating CWE-613 (Insufficient Session Expiration). The vulnerability allows unauthenticated remote attackers to reuse or hijack session tokens of recently logged-in users via network access. No authentication or user interaction is required to exploit this. An attacker can achieve full session takeover, accessing admin functionality with the privileges of the hijacked account. The issue was fixed in version 3.4.0; for older versions, archiving (3.x) or moving an account to trash (2.x) disables existing sessions as a workaround.

## Affected products

- Apostrophe Apostrophe CMS 2.63.0 to 3.3.1

## Identifiers

- CVE-2021-25979
- GHSA-9j9m-8wjc-ff96

## Timeline

- 2021-11-10: disclosed
- 2021-11-10: patched: Fixed in version 3.4.0

## References

- [https://github.com/apostrophecms/apostrophe/commit/c211b211f9f4303a77a307cf41aac9b4ef8d2c7c](https://github.com/apostrophecms/apostrophe/commit/c211b211f9f4303a77a307cf41aac9b4ef8d2c7c)

## Related threats

- [ApostropheCMS unauthenticated file upload in import routes](https://junglewise.ai/threats/cve-2026-113711-apostrophecms-is-an-open-source-node-js-content-management)
- [ApostropheCMS password-change endpoint lacks attempt throttling](https://junglewise.ai/threats/cve-2026-113710-apostrophecms-no-attempt-throttling-on-authenticated-password)
- [ApostropheCMS page REST API authorization bypass](https://junglewise.ai/threats/cve-2026-113670-apostrophecms-page-rest-api-authorization-bypass)
- [ApostropheCMS cross-domain session token in URL confers session takeover](https://junglewise.ai/threats/cve-2026-113669-apostrophecms-cross-domain-session-token-in-url-confers-session)
- [ApostropheCMS REST route authorization bypass in locales endpoint](https://junglewise.ai/threats/cve-2026-113668-apostrophecms-id-locales-rest-route-omits-the-public-api)