CVE-2026-112956: ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather than a repeated end-to-end reproduction. This issue is fixed in version 3.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ApostropheCMS import-export moduleto a version that resolves this vulnerability.Fixed in 3.7.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the ApostropheCMS import-export module before version 3.7.1 are affected when they have an import-enabled localized type and allow contributors to perform draft editing. The issue concerns replacement choices during duplicate-import continuation.
What access does an attacker need?
An attacker needs contributor-level draft editing authority. No user interaction is required, and the vulnerability can be reached over the network.
What is the impact of successful exploitation?
A contributor may select a published document as the replacement target during duplicate-import continuation and overwrite published content, crossing the normal publication boundary. The stated impact is integrity loss; no confidentiality or availability impact is indicated.
What should be done to remediate the issue?
Upgrade the @apostrophecms/import-export module to version 3.7.1, which fixes the issue. If upgrading cannot happen immediately, limit draft editing and import capabilities for contributors on import-enabled localized types.