TI-2026-26237 Aliases CVE-2026-33877 GHSA-mj7r-x3h3-7rmr

ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint

MEDIUM 51CWE-208Published 2026-04-15 · Updated 2026-04-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-208.

Summary

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-channel vulnerability in the password reset endpoint (/api/v1/@apostrophecms/login/reset-request) that allows unauthenticated username and email enumeration. When a user is not found, the handler returns after a fixed 2-second artificial delay, but when a valid user is found, it performs a MongoDB update and SMTP email send with no equivalent delay normalization, producing measurably different response times. The endpoint also accepts both username and email via an $or query, and has no rate limiting as the existing checkLoginAttempts throttle only applies to the login flow. This enables automated enumeration of valid accounts for use in credential stuffing or targeted phishing. Only instances that have explicitly enabled the passwordReset option are affected, as it defaults to false. This issue has been fixed in version 4.29.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00365 30th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed apostrophe (apostrophecms): 4.29.0apostrophe (npm): 4.29.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
apostrophecms	apostrophe	before 4.29.0	4.29.0	Patch available	CNA
—	apostrophe (npm)	before 4.29.0	4.29.0	Patch available	GHSA-mj7r-x3h3-7rmr

apostrophe Vendorapostrophecms Affected before 4.29.0 Fixed in 4.29.0 Patch available CNA
apostrophe (npm) Vendor— Affected before 4.29.0 Fixed in 4.29.0 Patch available GHSA-mj7r-x3h3-7rmr

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apostrophecms:apostrophecms::::::::	before 4.29.0	Vulnerable	apostrophecms

cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* Versions before 4.29.0 Vulnerable ·apostrophecms

Remediation

Fix · CNA apostrophe (apostrophecms) Fixed in 4.29.0
Fix · GHSA-mj7r-x3h3-7rmr apostrophe (npm) Fixed in 4.29.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-33877
2026-10-03 Alias added: GHSA-mj7r-x3h3-7rmr

References

TI-2026-27673 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVSS 3.1HIGH 8.7
TI-2026-25222 ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware CVSS 3.1HIGH 8.1
TI-2026-28738 Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions CVSS 3.1MEDIUM 5.3
TI-2026-26246 ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API CVSS 3.1MEDIUM 5.3
TI-2026-29000 ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements CVSS 3.1MEDIUM 6.1
TI-2026-26247 ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context CVSS 3.1MEDIUM 5.4

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences