ApostropheCMS is an open-source Node.js content management system.
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Microsoft
- Product
- azure
- CVSS
- 5.6
- Fix
- available
- Exposure class
- Cloud platform, Developer platform
Why it ranks 19 (Routine)
- CVSS 5.6 medium
- Product class: cloud platform, developer platform
- Widely deployed vendor product (Microsoft)
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-113652 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.