CVE-2026-53609: ApostropheCMS Server-Side Prototype Pollution Leading to Authorization Bypass
Summary
CVE-2026-53609: apos.util.set() traverses dot-notation paths without sanitizing proto, allowing an authenticated editor to write arbitrary values to Object.prototype via the $pullAll patch operator. Affects apostrophe versions < 4.31.0. Fixed in 4.31.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is an open-source content management system (CMS) designed for building websites and applications with a focus on ease of use and flexibility. It allows users to create and manage content through a user-friendly interface. However, a critical vulnerability has been identified that allows authenticated users to exploit the system, leading to unauthorized access and manipulation of data.
Vulnerability Detail
The vulnerability arises from the apos.util.set() function, which does not properly sanitize dot-notation paths. This oversight allows an authenticated editor to manipulate Object.prototype by using the $pullAll patch operator. As a result, an attacker can bypass authorization checks on REST API endpoints, leading to unauthorized access to sensitive data. The vulnerability persists until the Node.js process is restarted, posing a significant security risk.
How To Fix
Latest published version: 4.34.0 as of 23 Oct 2026
npm install apostrophe@4.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.31.0
This is the first release that contains the fix.
npm install apostrophe@4.31.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement validation checks to reject any path segments that include 'proto', 'constructor', or 'prototype' before passing user-controlled keys into the apos.util.set() function. Here is an example of how to implement this check:
if (p === '__proto__' || p === 'constructor' || p === 'prototype') {
return;
}
Conclusion
CVE-2026-53609 is a critical vulnerability in ApostropheCMS that allows for server-side prototype pollution, leading to potential authorization bypass. It is essential for users to update to the patched version 4.31.0 or later and implement necessary validation checks to secure their applications.
See every vulnerability recorded for apostrophe →
FAQ
CVE-2026-53609 is a critical vulnerability in ApostropheCMS that allows authenticated users to exploit server-side prototype pollution, leading to authorization bypass.
Any installation of ApostropheCMS with at least one editor-level account is affected, particularly in multi-user CMS deployments.
An attacker can bypass authorization checks, allowing unauthorized access to sensitive data and manipulation of the CMS.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
