Executive brief
ApostropheCMS, a content management system, contains a vulnerability that allows an authenticated editor to bypass security checks for the entire application. By sending a specially crafted request, an attacker can disable authorization requirements for sensitive data interfaces. This allows any unauthenticated user on the internet to access private information until the server is manually restarted, potentially leading to large-scale data exposure.
Technical details
A server-side prototype pollution vulnerability exists in ApostropheCMS versions up to 4.30.0. The 'apos.util.set' function in 'modules/@apostrophecms/util/index.js' fails to sanitize property keys such as '__proto__', 'constructor', or 'prototype' when traversing dot-notation paths. An authenticated editor can exploit this via the '$pullAll' patch operator in REST API endpoints to inject properties into 'Object.prototype'. Specifically, by setting 'publicApiProjection', an attacker can cause the 'publicApiCheck' function to evaluate to false, effectively bypassing authorization for all piece-type REST API endpoints (e.g., users, global settings) for all subsequent unauthenticated requests. The vulnerability is remediated in version 4.31.0 by implementing proper key sanitization.
Affected products
- ApostropheCMS apostrophe <= 4.30.0
Timeline
- 2026-06-11: disclosed
- 2026-06-12: kev added: NVD publication date
- 2026-07-31: advisory: GitHub Advisory published/updated
- 2026-07-31: patched: Version 4.31.0 released