CVE-2026-113665: ApostropheCMS Notification Module Lacks Authorization on PATCH/DELETE Endpoints
Summary
CVE-2026-113665: ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints. Affects apostrophe versions < 4.33.0. Fixed in 4.33.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is an open-source content management system (CMS) designed for building websites and applications with a focus on ease of use and flexibility. It allows developers to create rich content experiences while providing users with a straightforward interface for managing their content. However, the notification module of ApostropheCMS has been found to expose critical vulnerabilities in its REST API endpoints, specifically related to the PATCH and DELETE operations.
Vulnerability Detail
The ApostropheCMS notification module exposes PATCH and DELETE REST endpoints that directly manipulate the underlying MongoDB collection without verifying the requester's authentication or ownership of the target notification. This oversight allows unauthenticated attackers to modify or delete notifications belonging to other users, potentially leading to unauthorized access to sensitive information and disruption of user experience. The vulnerability arises from the lack of proper authentication checks and ownership validation in the affected endpoints, making them susceptible to exploitation.
How To Fix
Latest published version: 4.34.0 as of 23 Oct 2026
npm install apostrophe@4.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.33.0
This is the first release that contains the fix.
npm install apostrophe@4.33.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the notification endpoints by implementing middleware that checks for user authentication before allowing access to the PATCH and DELETE operations. This can be done by adding a middleware function that verifies if the user is logged in before processing the request.
Conclusion
The ApostropheCMS notification module's vulnerability (CVE-2026-113665) poses a significant risk by allowing unauthorized access to user notifications. It is crucial to update to the patched version and implement proper authentication and authorization checks to safeguard against potential exploitation.
See every vulnerability recorded for apostrophe →
FAQ
CVE-2026-113665 is a vulnerability in the ApostropheCMS notification module that allows unauthenticated users to modify or delete notifications belonging to other users.
You can use the Vulert platform to monitor and alert in real-time for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
An attacker can delete or modify notifications, suppress important alerts, and potentially disrupt user experience, leading to integrity issues within the application.
You can update ApostropheCMS to version 4.33.0 or later by running the command: npm install apostrophe@4.33.0.
Implement middleware to check for user authentication before allowing access to the PATCH and DELETE endpoints as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
