CVE-2026-113669Medium· 5.3▾ TwilightPoC availableApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Last analysed / modified upstream
Exploit / PoC code exists
0.3% → 0.4%
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This issue is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.
apostrophe < 4.33.0passport-bridge < 1.6.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
apostrophe < 4.33.0@apostrophecms/passport-bridge < 1.6.1Patched in:
apostrophe 4.33.0@apostrophecms/passport-bridge 1.6.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113665Low· 3.7ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
CVE-2026-113660Medium· 4.3ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
CVE-2026-113711High· 7.5ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
CVE-2026-113655Medium· 4.3ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
CVE-2026-113658High· 7.5ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
CVE-2026-113659Medium· 6.1ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users