CVE-2026-113648: ApostropheCMS: Missing Authentication in `cleanExport` Route
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@apostrophecms/import-exportto a version that resolves this vulnerability.Fixed in 3.7.1
Event History
Frequently Asked Questions
Who can exploit the exposed endpoint?
Any client can invoke the route, including an unauthenticated anonymous user. The attacker must first obtain the standard CSRF cookie by visiting the site.
Which deployments are affected?
Deployments using @apostrophecms/import-export versions before 3.7.1 are affected. The vulnerable endpoint is POST /api/v1/@apostrophecms/import-export/clean-export.
What action does successful exploitation perform?
A successful request triggers the underlying self.cleanExport(req) method. The provided information identifies integrity impact but does not specify the resulting changes in more detail.
How can the issue be remediated?
Update the @apostrophecms/import-export module to version 3.7.1, which includes the fix.