Is CVE-2026-45013 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45013 being exploited in the wild.

How severe is CVE-2026-45013?

High severity, with a CVSS score of 8.1, published 12 June 2026.

Which products and versions are affected?

ApostropheCMS <= 4.29.0; apostrophe (npm) <= 4.29.0, SEMVER:introduced=0,last_affected=4.29.0.

Is there a fix for CVE-2026-45013?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45013 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45013?

Check whether you run ApostropheCMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45013: ApostropheCMS account takeover via Host header injection in password reset

Q: Which products and versions are affected?

ApostropheCMS <= 4.29.0; apostrophe (npm) <= 4.29.0, SEMVER:introduced=0,last_affected=4.29.0.

Q: Is there a fix for CVE-2026-45013?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-45013 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-45013?

Check whether you run ApostropheCMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45013 · Severity: high · CVSS 8.1 · Published 2026-06-12

ApostropheCMS, a platform used for building and managing websites, contains a flaw in its password reset system. An attacker can trick the system into sending a legitimate password reset email to a user that contains a link pointing to a malicious website. If the user clicks this link, the attacker can steal their secret reset token and take over their account.

Technologies: ApostropheCMS, apostrophe (npm). Vendors: ApostropheCMS, npm.

Quick answers

Is CVE-2026-45013 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45013 being exploited in the wild.
How severe is CVE-2026-45013?: High severity, with a CVSS score of 8.1, published 12 June 2026.
Which products and versions are affected?: ApostropheCMS <= 4.29.0; apostrophe (npm) <= 4.29.0, SEMVER:introduced=0,last_affected=4.29.0.
Is there a fix for CVE-2026-45013?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45013 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45013?: Check whether you run ApostropheCMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

ApostropheCMS (up to version 4.29.0) is vulnerable to Host header injection within its password reset mechanism. When the 'apos.baseUrl' configuration is missing, the application uses the 'req.hostname' (derived from the HTTP Host header) to construct the password reset URL sent to users via email. An unauthenticated remote attacker can trigger a reset request for a known email address while providing a malicious Host header. If the victim clicks the resulting link, the valid reset token is transmitted to the attacker's server, allowing them to complete the reset process and achieve full account takeover. This vulnerability requires the 'passwordReset' option to be enabled and 'apos.baseUrl' to be unset.

Affected products

Apostrophe Technologies ApostropheCMS <= 4.29.0

Identifiers

CVE-2026-45013
GHSA-gf43-24g3-5hw2

Timeline

2026-05-13: advisory: GitHub Security Advisory published
2026-06-12: disclosed: CVE published to NVD

References

https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gf43-24g3-5hw2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.