# CVE-2026-112956: ApostropheCMS import-export authorization bypass in duplicate replacement

Source: https://junglewise.ai/threats/cve-2026-112956-apostrophecms-is-an-open-source-node-js-content-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-112956 · Severity: medium · CVSS 6.5 · Published 2026-10-20

ApostropheCMS is a Node.js content management system used to build and manage website content. A contributor with draft editing permission can bypass publication controls and modify published documents through the import feature by manipulating duplicate replacement choices without proper authorization. This allows unauthorized modifications to published content that should be protected.

Technologies: [ApostropheCMS Apostrophe](https://junglewise.ai/threats/technologies/apostrophecms-apostrophe), [@apostrophecms/import-export (npm)](https://junglewise.ai/threats/technologies/apostrophecms-import-export). Vendors: [ApostropheCMS](https://junglewise.ai/threats/vendors/apostrophecms), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-112956 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112956 being exploited in the wild.

**How severe is CVE-2026-112956?** Medium severity, with a CVSS score of 6.5, published 20 October 2026.

**Which products and versions are affected?** ApostropheCMS Apostrophe before 3.7.1; @apostrophecms/import-export (npm) < 3.7.1, SEMVER:introduced=0,fixed=3.7.1.

**Is there a fix for CVE-2026-112956?** Yes. @apostrophecms/import-export (npm): upgrade to 3.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112956 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112956?** Check whether you run ApostropheCMS Apostrophe or @apostrophecms/import-export (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @apostrophecms/import-export (npm): upgrade to 3.7.1 or later

  ```sh
  npm install @apostrophecms/import-export@3.7.1
  ```


## Technical details

The vulnerability exists in the import-export module prior to version 3.7.1, where client-supplied replacement choices during duplicate-import continuation are not bound to server-side analysis or authorization checks. A contributor with draft editing authority can select a published document as a replacement target, crossing the publication boundary without the required publish permission. The fix validates and authorizes the actual target document on the server side.

## Affected products

- ApostropheCMS Apostrophe before 3.7.1

## Identifiers

- CVE-2026-112956
- GHSA-jf5h-36mg-rp6x

## Timeline

- 2026-10-20: disclosed

## References

- [https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498](https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498)
- [https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea](https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea)

## Related threats

- [ApostropheCMS unauthenticated file upload in import routes](https://junglewise.ai/threats/cve-2026-113711-apostrophecms-is-an-open-source-node-js-content-management)
- [ApostropheCMS import-export tar path traversal and crash](https://junglewise.ai/threats/cve-2026-113664-apostrophecms-import-export-tar-guard-misses-because-it-is-a)
- [ApostropheCMS import-export NoSQL injection in update-key](https://junglewise.ai/threats/cve-2026-113662-apostrophecms-import-export-nosql-injection-via-update-key-value)
- [ApostropheCMS authorization bypass in exist-in-locale API](https://junglewise.ai/threats/cve-2026-113660-apostrophecms-authenticated-object-level-authorization-bypass-in)
- [ApostropheCMS unauthenticated CSV upload denial of service](https://junglewise.ai/threats/cve-2026-113658-apostrophecms-is-an-open-source-node-js-content-management)