CVE-2026-113648
ApostropheCMS: Missing Authentication in `cleanExport` Route
CVSS Score
3.1
EPSS Score
0.0%
EPSS Percentile
0th
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.
| CWE | CWE-306 CWE-862 |
| Vendor | apostrophecms |
| Product | apostrophe |
| Published | Oct 20, 2026 |
| Last Updated | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for apostrophecms apostrophe
Be the first to know when new low vulnerabilities affecting apostrophecms apostrophe are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
apostrophecms / apostrophe
< 4.34.0
@apostrophecms / import-export
< 3.7.1
References
github.com: https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rw26-wwfc-9wvm github.com: https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498 github.com: https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea github.com: https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/[email protected]