CVE-2021-25979: Apostrophe CMS Insufficient Session Expiration Vulnerability
Summary
CVE-2021-25979: Apostrophe CMS Insufficient Session Expiration vulnerability. Affects apostrophe versions >= 2.63.0, < 3.4.0. Fixed in 3.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apostrophe CMS is an open-source content management system built on Node.js and MongoDB. It provides a flexible and extensible platform for creating and managing websites. The vulnerability identified as CVE-2021-25979 affects versions 2.63.0 to 3.3.1 of Apostrophe CMS. This vulnerability allows unauthenticated remote attackers to hijack recently logged-in users' sessions. The session expiration mechanism is insufficient, enabling attackers to exploit active sessions and gain unauthorized access to user accounts.
Vulnerability Detail
The insufficient session expiration vulnerability in Apostrophe CMS poses a significant security risk. Attackers can exploit this vulnerability to take control of active user sessions, potentially leading to unauthorized access, data theft, or privilege escalation. The vulnerability arises from a flaw in the session management mechanism, which fails to terminate sessions after a certain period of inactivity. As a result, even after a user logs out or their session should expire, the session remains active and can be hijacked by an attacker. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 4.34.0 as of 23 Oct 2026
npm install apostrophe@4.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.0
This is the first release that contains the fix.
npm install apostrophe@3.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended steps for fixing the vulnerability by upgrading to the latest version or archiving/moving the user account.
Conclusion
The Apostrophe CMS Insufficient Session Expiration vulnerability (CVE-2021-25979) poses a critical security risk, allowing unauthenticated attackers to hijack active user sessions. Upgrading to the fixed version or taking appropriate actions to disable the existing session is crucial to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for apostrophe →
FAQ
Apostrophe CMS is an open-source content management system built on Node.js and MongoDB. It provides a flexible and extensible platform for creating and managing websites.
The vulnerability allows unauthenticated remote attackers to hijack recently logged-in users' sessions. This can lead to unauthorized access, data theft, or privilege escalation.
Versions between 2.63.0 and 3.3.1 of Apostrophe CMS are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to version 3.4.0 of Apostrophe CMS. Users on older versions can archive or move the user account in question to disable the existing session.
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended steps for fixing the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
