TI-2026-29000 CVE-2026-40186 · GHSA-9mrh-v2v3-xpfm
ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
Priority MEDIUM 60
ApostropheCMS is an open-source Node.js content management system.
Vulnerabilities
9 records
TI-2026-28738 CVE-2026-39857 · GHSA-c276-fj82-f2pq
Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions
Priority MEDIUM 63
ApostropheCMS is an open-source Node.js content management system.
TI-2026-27673 CVE-2026-35569 · GHSA-855c-r2vq-c292
ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
Priority HIGH 73
ApostropheCMS is an open-source Node.js content management system.
TI-2026-26247 CVE-2026-33889 · GHSA-97v6-998m-fp4g
ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context
Priority MEDIUM 58
ApostropheCMS is an open-source Node.js content management system.
TI-2026-26246 CVE-2026-33888 · GHSA-xhq9-58fw-859p
ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API
Priority MEDIUM 63
ApostropheCMS is an open-source Node.js content management system.
TI-2026-26237 CVE-2026-33877 · GHSA-mj7r-x3h3-7rmr
ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint
Priority MEDIUM 51
ApostropheCMS is an open-source Node.js content management system.
TI-2026-25222 CVE-2026-32730 · GHSA-v9xm-ffx2-7h35
ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
Priority HIGH 70
ApostropheCMS is an open-source content management framework.
TI-2021-07985 CVE-2021-25979 · GHSA-9j9m-8wjc-ff96
Apostrophe - Insufficient Session Expiration
Priority MEDIUM 51
Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be l…
TI-2021-07984 CVE-2021-25978 · GHSA-4r9c-jghc-cx5m
Apostrophe - XSS
Priority LOW 25
Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.