Executive brief
ApostropheCMS, a platform used for building and managing websites, contains a flaw in its password reset system. An attacker can trick the system into sending a legitimate password reset email to a user that contains a link pointing to a malicious website. If the user clicks this link, the attacker can steal their secret reset token and take over their account.
Technical details
ApostropheCMS (up to version 4.29.0) is vulnerable to Host header injection within its password reset mechanism. When the 'apos.baseUrl' configuration is missing, the application uses the 'req.hostname' (derived from the HTTP Host header) to construct the password reset URL sent to users via email. An unauthenticated remote attacker can trigger a reset request for a known email address while providing a malicious Host header. If the victim clicks the resulting link, the valid reset token is transmitted to the attacker's server, allowing them to complete the reset process and achieve full account takeover. This vulnerability requires the 'passwordReset' option to be enabled and 'apos.baseUrl' to be unset.
Affected products
- Apostrophe Technologies ApostropheCMS <= 4.29.0
Timeline
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD