CVE-2026-32730: ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
Summary
CVE-2026-32730: ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware. Affects apostrophe versions < 4.28.0. Fixed in 4.28.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ApostropheCMS is a powerful open-source content management system (CMS) designed for building websites and applications. It provides a flexible and user-friendly interface for managing content, allowing developers to create custom modules and integrate various functionalities. However, a critical vulnerability has been identified in its authentication mechanism, specifically in the multi-factor authentication (MFA) process, which can lead to unauthorized access if exploited.
Vulnerability Detail
The vulnerability arises from an incorrect MongoDB query in the bearer token authentication middleware of ApostropheCMS. This flaw allows attackers to bypass multi-factor authentication (MFA) by using incomplete login tokens, where the password has been verified, but the Time-based One-Time Password (TOTP) or MFA requirements have not been met. The query incorrectly matches tokens that still have unverified requirements, negating the security benefits of MFA. As a result, an attacker who knows a user's password can gain full access to the system without providing the required TOTP code, leading to potential data breaches and unauthorized actions.
How To Fix
Latest published version: 4.34.0 as of 23 Oct 2026
npm install apostrophe@4.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.28.0
This is the first release that contains the fix.
npm install apostrophe@4.28.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the MongoDB query in the bearer token middleware to replace the incorrect condition. Change the query from: { requirementsToVerify: { $ne: [] } } to { requirementsToVerify: { $size: 0 } } to ensure that only tokens with no remaining requirements are accepted.
Conclusion
The vulnerability CVE-2026-32730 in ApostropheCMS poses a significant risk by allowing attackers to bypass multi-factor authentication through an incorrect MongoDB query. It is crucial for users of ApostropheCMS to update to the latest version to mitigate this risk and ensure the security of their applications. Regular monitoring with tools like Vulert can help maintain awareness of potential vulnerabilities.
See every vulnerability recorded for apostrophe →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to user accounts, data breaches, and potential manipulation of sensitive information.
Yes, a patch is available in version 4.28.0 of ApostropheCMS, which corrects the underlying issue.
If you cannot update immediately, implement the suggested workaround to modify the MongoDB query to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
