Is CVE-2026-33877 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33877 being exploited in the wild.

How severe is CVE-2026-33877?

Low severity, with a CVSS score of 3.7, published 15 April 2026.

Which products and versions are affected?

ApostropheCMS < 4.29.0; apostrophe (npm) < 4.29.0, SEMVER:introduced=0,fixed=4.29.0.

Is there a fix for CVE-2026-33877?

Yes. apostrophe (npm): upgrade to 4.29.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33877 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33877?

Check whether you run ApostropheCMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33877: ApostropheCMS user enumeration via timing side channel in password reset

Q: Which products and versions are affected?

ApostropheCMS < 4.29.0; apostrophe (npm) < 4.29.0, SEMVER:introduced=0,fixed=4.29.0.

Q: Is there a fix for CVE-2026-33877?

Yes. apostrophe (npm): upgrade to 4.29.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33877 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-33877?

Check whether you run ApostropheCMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33877 · Severity: low · CVSS 3.7 · Published 2026-04-15

ApostropheCMS is a content management system used to build and manage websites. A flaw in its password reset feature allows unauthorized individuals to determine if a specific username or email address exists on the site by measuring how long the server takes to respond. This information can be used to target specific users for phishing or to prepare for more advanced account takeover attempts.

Technologies: ApostropheCMS, apostrophe (npm). Vendors: ApostropheCMS, npm.

Quick answers

Is CVE-2026-33877 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33877 being exploited in the wild.
How severe is CVE-2026-33877?: Low severity, with a CVSS score of 3.7, published 15 April 2026.
Which products and versions are affected?: ApostropheCMS < 4.29.0; apostrophe (npm) < 4.29.0, SEMVER:introduced=0,fixed=4.29.0.
Is there a fix for CVE-2026-33877?: Yes. apostrophe (npm): upgrade to 4.29.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33877 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33877?: Check whether you run ApostropheCMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apostrophe (npm): upgrade to 4.29.0 or later
```
npm install apostrophe@4.29.0
```

Technical details

The password reset endpoint (`/api/v1/@apostrophecms/login/reset-request`) in ApostropheCMS contains a timing side channel (CWE-208). While the application implements a fixed 2-second delay when a user is not found, it fails to normalize the timing when a user is found. In the 'user found' path, the system performs MongoDB updates and SMTP operations without an equivalent artificial delay, leading to measurable timing differences. An unauthenticated attacker can exploit this by sending automated requests and statistically analyzing response times to identify valid accounts. The vulnerability is present when the `passwordReset` option is enabled (it is disabled by default). Version 4.29.0 fixes this by ensuring all code paths adhere to a minimum response time.

Affected products

ApostropheCMS apostrophe < 4.29.0

Identifiers

CVE-2026-33877
GHSA-mj7r-x3h3-7rmr

Timeline

2026-04-15: disclosed
2026-04-15: patched: Fixed in version 4.29.0
2026-04-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.