Read the docs
TI-2026-32871 Aliases CVE-2026-45013GHSA-gf43-24g3-5hw2

Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation

Priority HIGH 70CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-640.

Summary

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTTP `Host` header when `apos.baseUrl` is not explicitly configured. An unauthenticated attacker who knows a victim's email address can send a crafted reset request that causes the application to email the victim a reset link pointing to the attacker's domain. When the victim clicks the link, the valid reset token is delivered to the attacker, enabling full account takeover. As of time of publication, no known patched versions are available.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00305 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
apostrophecmsapostropheup to 4.29.0—No fix listedCNA
—apostrophe (npm)up to 4.29.0—No fix listedGHSA-gf43-24g3-5hw2
  • apostrophe Vendorapostrophecms Affected up to 4.29.0 Fixed in — No fix listed CNA
  • apostrophe (npm) Vendor— Affected up to 4.29.0 Fixed in — No fix listed GHSA-gf43-24g3-5hw2

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*——apostrophecms
  • cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* Versions — — ·apostrophecms

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45013
  2. 2026-10-03 Alias added: GHSA-gf43-24g3-5hw2

References

Advisory 1

Other 2

  • TI-2026-25223 ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction CVSS 3.1CRITICAL 10.0
  • TI-2026-32848 Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` CVSS 3.1CRITICAL 9.3
  • TI-2026-38664 @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag CVSS 3.1HIGH 8.7
  • TI-2026-27673 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVSS 3.1HIGH 8.7
  • TI-2026-76992 Unauthenticated resource exhaustion via ApostropheCMS import routes CVSS 3.1HIGH 7.5
  • TI-2026-76974 ApostropheCMS leaves rejected CSV uploads in temporary directory CVSS 3.1HIGH 7.5
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences