ApostropheCMS: Missing Authentication in `cleanExport` Route
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.
CVE-2026-113648
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-113648
apostrophe
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
import-export
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "apostrophecms",
"product": "apostrophe",
"versions": [
{
"status": "affected",
"version": "< 4.34.0"
}
]
},
{
"vendor": "@apostrophecms",
"product": "import-export",
"versions": [
{
"status": "affected",
"version": "< 3.7.1"
}
]
}
]- Related CVEs
- CVE-2026-113648
Source reference:
/cveMetadata/cveId
Publisher severity
low
Source reference: /containers/cna/metrics
- Event
- #52541 · Revision 1
- Added to Heist Feed
- Publisher date