Skip to content
Heist/ feed
Low

ApostropheCMS: Missing Authentication in `cleanExport` Route

Type: advisorySource: Official CVE List1 source record

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.

Announced Source revision 1
Original source ↗

CVE-2026-113648

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-113648

apostrophe

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

import-export

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "apostrophecms",
    "product": "apostrophe",
    "versions": [
      {
        "status": "affected",
        "version": "< 4.34.0"
      }
    ]
  },
  {
    "vendor": "@apostrophecms",
    "product": "import-export",
    "versions": [
      {
        "status": "affected",
        "version": "< 3.7.1"
      }
    ]
  }
]
Related CVEs
CVE-2026-113648

Source reference: /cveMetadata/cveId

Publisher severity

low

Source reference: /containers/cna/metrics

Event
#52541 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement