CVE-2026-32730: ApostropheCMS MFA/TOTP bypass in bearer token middleware

CVE-2026-32730 · Severity: low · CVSS 3.1 · Published 2026-03-18

ApostropheCMS is a content management system used to build and manage websites. A logic error in the authentication middleware allows attackers who have obtained a user's password to bypass multi-factor authentication (MFA/TOTP) entirely, gaining full access to accounts and data without providing a second authentication factor. This undermines the core security purpose of MFA, which is to protect accounts when passwords are compromised through phishing, credential stuffing, or breaches.

Technologies: ApostropheCMS, apostrophe (npm). Vendors: ApostropheCMS, npm.

Quick answers

Is CVE-2026-32730 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32730 being exploited in the wild.
How severe is CVE-2026-32730?
Low severity, with a CVSS score of 3.1, published 18 March 2026.
Which products and versions are affected?
ApostropheCMS 3.0.0 to 4.27.1; apostrophe (npm) SEMVER:introduced=0,fixed=4.28.0.
Is there a fix for CVE-2026-32730?
Yes. apostrophe (npm): upgrade to 4.28.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32730 attacked?
It is attacked over the network.
Am I affected by CVE-2026-32730?
Check whether you run ApostropheCMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • apostrophe (npm): upgrade to 4.28.0 or later
    npm install apostrophe@4.28.0

Technical details

The vulnerability is an authentication bypass caused by an inverted MongoDB query condition in the bearer token validation logic (@apostrophecms/express/index.js, lines 386–389). The getBearer() function uses `$ne: []` to match tokens where the requirementsToVerify array is not empty; however, the intended logic was to only accept tokens where the array is absent or empty (indicating all MFA requirements are satisfied). An attacker who knows the victim's password can authenticate, receive an "incompleteToken" (which has MFA requirements still pending), and use that token as a bearer token for API requests. The inverted query incorrectly validates the incomplete token, granting full authenticated access without TOTP verification. Attack vector is network-based with no user interaction required, but requires prior knowledge of the victim's password. The vulnerability affects ApostropheCMS versions 3.0.0 through 4.27.1 when @apostrophecms/login-totp or custom afterPasswordVerified requirements are configured. A fix is available in version 4.28.0.

Affected products

  • ApostropheCMS ApostropheCMS 3.0.0 to 4.27.1

Identifiers

  • CVE-2026-32730
  • GHSA-v9xm-ffx2-7h35

Timeline

  • 2026-03-18: disclosed: Advisory published
  • 2026-03-18: patched: Fix available in version 4.28.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.