CVE-2026-113710: ApostropheCMS Password Change Endpoint Lacks Throttling Mechanism
Summary
CVE-2026-113710: Summary The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. Affects apostrophe versions < 4.33.0. Fixed in 4.33.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is an open-source content management system (CMS) designed for building websites and applications with a focus on ease of use and flexibility. It provides a range of features including user management, content editing, and customizable settings. However, a vulnerability has been identified in its password change functionality, which allows an attacker with an authenticated session to exploit the system without any throttling or lockout mechanisms in place.
Vulnerability Detail
The vulnerability arises from the password-change endpoint, which verifies the current password but fails to implement any form of throttling or lockout after failed attempts. This means that an attacker with a valid authenticated session can repeatedly guess the current password without facing any restrictions. The lack of a failed-attempt counter or delay mechanism allows for unlimited guessing, potentially leading to account takeover if the current password is weak or reused. The vulnerability is located in the password verification logic and is exacerbated by the absence of security measures typically found in login processes.
How To Fix
Latest published version: 4.34.0 as of 23 Oct 2026
npm install apostrophe@4.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.33.0
This is the first release that contains the fix.
npm install apostrophe@4.33.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional monitoring on user sessions and alerting for suspicious activity. Additionally, enforce strong password policies to mitigate the risk of weak passwords being exploited.
Conclusion
The vulnerability CVE-2026-113710 in ApostropheCMS presents a significant risk due to the lack of throttling on the password change endpoint. It is crucial for users to update to the patched version to secure their applications against potential account takeover attacks. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for apostrophe →
FAQ
CVE-2026-113710 is a vulnerability in ApostropheCMS that allows attackers to guess current passwords without any throttling or lockout mechanisms, potentially leading to account takeover.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 5.9, indicating a moderate level of risk.
If an immediate update is not possible, implement strong password policies and monitor user sessions for unusual activity as a temporary measure.
While a patch is the best solution, you can enforce strong password requirements and monitor for repeated failed attempts as a temporary mitigation strategy.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
