Apostrophecms
CVE-2026-112956: ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-cont
CVE-2026-112956 Oct 20, 2026 Source: Vendor
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediat
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-112956
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
0 lines
No credit lines recorded on this release yet.