---
id: CVE-2026-113665
title: 'ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints'
summary: >-
  ApostropheCMS is an open-source Node.js content management system. Prior to
  4.33.0, the notification module exposes PATCH and DELETE REST endpoints that
  perform operations directly on the underlying MongoDB collection without
  verifying t…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
  - CWE-862
vendor: apostrophecms
product: apostrophe
affected:
  - apostrophe < 4.33.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-28T13:57:36.942400Z'
exploitAvailable: true
published: '2026-10-20'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T13:57:53.391Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113665'
references:
  - url: >-
      https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrc
    label: >-
      https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrc
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
    label: >-
      https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
    label: >-
      https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
  - url: 'https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0'
    label: 'https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0'
  - url: 'https://github.com/advisories/GHSA-vwwx-px9w-crrc'
tags:
  - cve.org
  - exploit-available
  - ghsa
  - npm
epss: 0.00276
epssPercentile: 0.19927
aliases:
  - GHSA-vwwx-px9w-crrc
ecosystem: npm
patched:
  - apostrophe 4.33.0
ingestedAt: '2026-10-20T18:14:37.221Z'
---

## Overview

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.

## Affected

- `apostrophe < 4.33.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-113665)

Affected packages:

- `apostrophe < 4.33.0`

Patched in:

- `apostrophe 4.33.0`

Source: https://github.com/advisories/GHSA-vwwx-px9w-crrc