# CVE-2026-45013: ApostropheCMS account takeover via Host header injection in password reset

Source: https://junglewise.ai/threats/cve-2026-45013-apostrophecms-account-takeover-via-host-header-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-45013 · Severity: high · CVSS 8.1 · Published 2026-06-12

ApostropheCMS, a platform used for building and managing websites, contains a flaw in its password reset system. An attacker can trick the system into sending a legitimate password reset email to a user that contains a link pointing to a malicious website. If the user clicks this link, the attacker can steal their secret reset token and take over their account.

Technologies: [ApostropheCMS](https://junglewise.ai/threats/technologies/apostrophecms), [apostrophe (npm)](https://junglewise.ai/threats/technologies/apostrophe). Vendors: [ApostropheCMS](https://junglewise.ai/threats/vendors/apostrophecms), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-45013 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45013 being exploited in the wild.

**How severe is CVE-2026-45013?** High severity, with a CVSS score of 8.1, published 12 June 2026.

**Which products and versions are affected?** ApostropheCMS <= 4.29.0; apostrophe (npm) <= 4.29.0, SEMVER:introduced=0,last_affected=4.29.0.

**Is there a fix for CVE-2026-45013?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45013 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45013?** Check whether you run ApostropheCMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

ApostropheCMS (up to version 4.29.0) is vulnerable to Host header injection within its password reset mechanism. When the 'apos.baseUrl' configuration is missing, the application uses the 'req.hostname' (derived from the HTTP Host header) to construct the password reset URL sent to users via email. An unauthenticated remote attacker can trigger a reset request for a known email address while providing a malicious Host header. If the victim clicks the resulting link, the valid reset token is transmitted to the attacker's server, allowing them to complete the reset process and achieve full account takeover. This vulnerability requires the 'passwordReset' option to be enabled and 'apos.baseUrl' to be unset.

## Affected products

- Apostrophe Technologies ApostropheCMS <= 4.29.0

## Identifiers

- CVE-2026-45013
- GHSA-gf43-24g3-5hw2

## Timeline

- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD

## References

- [https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gf43-24g3-5hw2](https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gf43-24g3-5hw2)

## Related threats

- [ApostropheCMS unauthenticated file upload in import routes](https://junglewise.ai/threats/cve-2026-113711-apostrophecms-is-an-open-source-node-js-content-management)
- [ApostropheCMS password-change endpoint lacks attempt throttling](https://junglewise.ai/threats/cve-2026-113710-apostrophecms-no-attempt-throttling-on-authenticated-password)
- [ApostropheCMS page REST API authorization bypass](https://junglewise.ai/threats/cve-2026-113670-apostrophecms-page-rest-api-authorization-bypass)
- [ApostropheCMS cross-domain session token in URL confers session takeover](https://junglewise.ai/threats/cve-2026-113669-apostrophecms-cross-domain-session-token-in-url-confers-session)
- [ApostropheCMS REST route authorization bypass in locales endpoint](https://junglewise.ai/threats/cve-2026-113668-apostrophecms-id-locales-rest-route-omits-the-public-api)