TI-2026-25222 Aliases CVE-2026-32730 GHSA-v9xm-ffx2-7h35

ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

HIGH 70CWE-287Published 2026-03-18 · Updated 2026-03-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement. Version 4.28.0 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00384 32nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed apostrophe (apostrophecms): 4.28.0apostrophe (npm): 4.28.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
apostrophecms	apostrophe	before 4.28.0	4.28.0	Patch available	CNA
—	apostrophe (npm)	before 4.28.0	4.28.0	Patch available	GHSA-v9xm-ffx2-7h35

apostrophe Vendorapostrophecms Affected before 4.28.0 Fixed in 4.28.0 Patch available CNA
apostrophe (npm) Vendor— Affected before 4.28.0 Fixed in 4.28.0 Patch available GHSA-v9xm-ffx2-7h35

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apostrophecms:apostrophecms::::::::	before 4.28.0	Vulnerable	apostrophecms

cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* Versions before 4.28.0 Vulnerable ·apostrophecms

Remediation

Fix · CNA apostrophe (apostrophecms) Fixed in 4.28.0
Fix · GHSA-v9xm-ffx2-7h35 apostrophe (npm) Fixed in 4.28.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-32730
2026-10-03 Alias added: GHSA-v9xm-ffx2-7h35

References

TI-2026-27673 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVSS 3.1HIGH 8.7
TI-2026-28738 Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions CVSS 3.1MEDIUM 5.3
TI-2026-26246 ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API CVSS 3.1MEDIUM 5.3
TI-2026-29000 ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements CVSS 3.1MEDIUM 6.1
TI-2026-26247 ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context CVSS 3.1MEDIUM 5.4
TI-2026-26237 ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint CVSS 3.1LOW 3.7

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences