{"schemaVersion":3,"id":"CVE-2026-113665","aliases":["GHSA-vwwx-px9w-crrc"],"status":"published","duplicateOf":null,"title":null,"description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.","dates":{"published":"2026-10-20T17:19:56.123Z","modified":"2026-10-20T17:19:56.123Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":3.7,"severity":"low","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":5.6,"impact":2.3,"computed":true}]},"epss":{"probability":0.00276,"percentile":0.18955,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-21T00:00:00.000Z","score":0.00276,"percentile":0.18955}],"last30":[{"date":"2026-10-21T00:00:00.000Z","score":0.00276,"percentile":0.18955}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key","description":"The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/639.html"},{"id":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/862.html"}],"affected":[{"vendor":"apostrophecms","product":"apostrophe","name":"apostrophe","label":"apostrophe","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.33.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.33.0","eol":null,"hubHref":"/vendor/apostrophecms/apostrophe"},{"vendor":"Npm","product":"apostrophe","name":"apostrophe","label":"apostrophe","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/apostrophe","purlType":"npm","versions":[{"text":"< 4.33.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.33.0","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrc","label":"github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrc","hostname":"github.com","tags":["X Refsource CONFIRM","WEB"]},{"url":"https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","label":"github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","label":"github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0","label":"github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/apostrophecms/apostrophe","label":"github.com/apostrophecms/apostrophe","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-20T17:19:56.123Z","label":"Published","detail":"Vulnerability first disclosed.","source":null}],"risk":{"score":15,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T19:59:46.449Z","stale":false,"partial":false}}