CVE-2026-112956: ApostropheCMS Import-Export Package Allows Unauthorized Content Overwrite
Summary
CVE-2026-112956: ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content. Affects @apostrophecms/import-export versions < 3.7.1. Fixed in 3.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @apostrophecms/import-export package, version 3.7.0, is part of the ApostropheCMS framework, which is designed for building content-rich websites. This package facilitates the import and export of content, enabling users to manage their data effectively. However, it has been found to have a vulnerability that allows unauthorized contributors to overwrite published content, posing a significant risk to content integrity.
Vulnerability Detail
The vulnerability arises from the overrideDuplicates() continuation, which accepts client-supplied replacement choices without proper validation. This flaw allows contributors to bypass publication boundaries and replace published content with unauthorized data. The lack of a server-maintained identity context for replacements means that the system does not adequately verify the authority of the user making the changes, leading to potential data integrity issues. If exploited, this could result in unauthorized modifications to published content, affecting the trustworthiness of the website.
How To Fix
Latest published version: 3.7.1 as of 22 Oct 2026
npm install @apostrophecms/import-export@3.7.1The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your import process to ensure that only authorized users can perform content replacements. This may involve binding the continuation state to the initiating user and validating permissions against the actual loaded target before allowing any updates.
Conclusion
The vulnerability identified as CVE-2026-112956 in the @apostrophecms/import-export package poses a significant risk by allowing unauthorized content overwrites. It is crucial for users to update to the patched version 3.7.1 to mitigate this risk and ensure the integrity of their published content.
See every vulnerability recorded for @apostrophecms/import-export →
FAQ
The vulnerability allows unauthorized users to overwrite published content due to insufficient validation in the import process.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to unauthorized changes in published content, compromising the integrity and trustworthiness of your website.
Yes, a patch is available in version 3.7.1 of the @apostrophecms/import-export package. It is recommended to update to this version.
The CVSS score of this vulnerability is 6.5, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for @apostrophecms/import-export.
