CVE-2026-113649: ApostropheCMS: Import API bypasses publication roles for protected content
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove published variants without the normal publish permission and lifecycle checks. This issue is fixed in import-export 3.7.1 and ApostropheCMS 4.34.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ApostropheCMS import-export moduleto a version that resolves this vulnerability.Fixed in 3.7.1 - Upgrade
Upgrade
ApostropheCMS coreto a version that resolves this vulnerability.Fixed in 4.34.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An editor must be able to import an enabled content type while lacking the stronger role normally required to publish that content type. Unauthenticated users and editors without import access are not described as able to exploit it.
Are default deployments affected?
The issue depends on the import-export capability being enabled for a content type and on an editor having import permission without the corresponding stronger publication role. The provided information does not establish whether that permission combination exists by default.
What changes can a successful attacker make?
The affected import write helpers can create, replace, or remove published variants of protected content. This bypasses the normal publish permission and lifecycle checks.
What should be done if an immediate upgrade is not possible?
Restrict import access for enabled content types to users who also hold the applicable publication role, or disable imports for those content types. This prevents the described permission mismatch from being used.
Which versions contain fixes?
Upgrade the import-export module to version 3.7.1 or later and core ApostropheCMS to version 4.34.0 or later.