Executive brief
ApostropheCMS is a headless content management system used to manage and publish digital content. An authenticated attacker can submit a single malicious request to the API that permanently breaks the application by corrupting core JavaScript functions, making it unavailable to all users until the server is restarted. This requires valid editor credentials but results in full service disruption.
Technical details
The vulnerability is a second-order prototype pollution flaw in the PATCH API endpoint (e.g., PATCH /api/v1/article/<id>) that fails to sanitize user input before merging it into JavaScript objects. An authenticated attacker with editor privileges can inject a crafted JSON payload such as {"toString.call":"x"} to overwrite critical prototype chain properties, including global methods like toString(). This causes all subsequent operations that rely on these methods to fail catastrophically, resulting in a persistent denial of service that affects the entire application and persists across requests until the server is restarted. The attack requires valid editor-level authentication but no user interaction or complex exploitation steps.
Affected products
- ApostropheCMS apostrophe <= 4.32.0
Timeline
- 2026-09-02: disclosed: Published to GitHub Advisory Database
- 2026-08-17: advisory: Published to NVD
- 2026-08-12: other: Vulnerability reported
References
- https://api.github.com/users/breakingsystems
- https://github.com/breakingsystems
- https://api.github.com/users/breakingsystems/gists%7B/gist_id%7D
- https://api.github.com/users/breakingsystems/repos
- https://avatars.githubusercontent.com/u/72152138?v=4
- https://api.github.com/users/breakingsystems/events%7B/privacy%7D