CVE-2026-71553High▾ TwilightApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.4%
Last analysed / modified upstream
The vulnerability is a single-request persistent DoS by submitting e.g. "PATCH /api/v1/article/<id>" with a valid editor session and body of {"toString.call":"x"}, overwriting the global toString function with value x.
Fabian
apostrophe <= 4.32.0Upgrade to a patched release:
apostrophe 4.32.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113659Medium· 6.1ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
CVE-2026-53609Critical· 9.1Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
CVE-2026-113661Medium· 5.4ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
CVE-2026-113662Medium· 5.4ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
CVE-2026-113664Medium· 5.3ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
CVE-2026-113665Low· 3.7ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints