Apostrophe - Insufficient Session Expiration
Priority MEDIUM 51CWE-613Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.
Summary
Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0114 66th percentileScored 2026-11-07
Fix Fixed apostrophe (npm): 3.4.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apostrophe | Apostrophe | up to 3.3.1; 2.63.0 and later | — | No fix listed | CNA |
| — | apostrophe (npm) | 2.63.0 to before 3.4.0 | 3.4.0 | Patch available | GHSA-9j9m-8wjc-ff96 |
- Apostrophe VendorApostrophe Affected up to 3.3.1; 2.63.0 and later Fixed in — No fix listed CNA
- apostrophe (npm) Vendor— Affected 2.63.0 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-9j9m-8wjc-ff96
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* | 2.63.0 to before 3.3.1 | Vulnerable | apostrophecms |
- cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* Versions 2.63.0 to before 3.3.1 Vulnerable ·apostrophecms
Remediation
- Fix · GHSA-9j9m-8wjc-ff96 apostrophe (npm) Fixed in 3.4.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-25979
- 2026-10-03 Alias added: GHSA-9j9m-8wjc-ff96
References
More Apostrophecms vulnerabilities
- TI-2026-27673 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVSS 3.1HIGH 8.7
- TI-2026-25222 ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware CVSS 3.1HIGH 8.1
- TI-2026-28738 Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions CVSS 3.1MEDIUM 5.3
- TI-2026-26246 ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API CVSS 3.1MEDIUM 5.3
- TI-2026-29000 ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements CVSS 3.1MEDIUM 6.1
- TI-2026-26247 ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context CVSS 3.1MEDIUM 5.4
Sources
- CVE-2021-25979 · CVE Program
- CVE-2021-25979 · NVD
- FIRST EPSS
- GHSA-9j9m-8wjc-ff96 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences