CVE-2026-113648: ApostropheCMS Import-Export Package Lacks Authentication in Clean Export Route

Background

ApostropheCMS is an open-source content management system (CMS) designed for building websites and applications. It provides a flexible and user-friendly interface for managing content, allowing developers to create custom modules and features. The '@apostrophecms/import-export' package facilitates the import and export of content, enabling users to manage data efficiently. However, this package has a critical vulnerability that exposes certain API endpoints to unauthorized access, potentially compromising the integrity of the application.

Vulnerability Detail

The vulnerability arises from the absence of authentication and authorization checks in the API endpoint 'POST /api/v1/@apostrophecms/import-export/clean-export'. This oversight allows unauthenticated users, who have obtained a CSRF cookie, to invoke the clean export functionality directly. As a result, unauthorized users can delete temporary export files, modify job records in the database, and dismiss notifications without proper verification. The root cause is the lack of an explicit check for 'req.user' in the route definition, which permits anonymous requests to bypass access control.

npm install @apostrophecms/import-export@3.7.1

Workaround

As a temporary workaround, you can implement a middleware function to check for user authentication before allowing access to the vulnerable endpoint. Here is an example of how to do this:

function authenticate(req, res, next) {
  if (!req.user) {
    return res.status(403).send('Forbidden');
  }
  next();
}

app.post('/api/v1/@apostrophecms/import-export/clean-export', authenticate, (req, res) => {
  // Your clean export logic here
});

Conclusion

The vulnerability CVE-2026-113648 in the '@apostrophecms/import-export' package poses a significant risk due to the lack of authentication checks in the clean export route. It is crucial to update the package to the latest version to mitigate this risk and ensure the security of your application.

See every vulnerability recorded for @apostrophecms/import-export →

FAQ