Vulnerabilities

ApostropheCMS is an open-source Node.js content management system.

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Node.js

Product

Node.js

CVSS

3.1

Fix

available

Exposure class

Developer platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-113648 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 20
   CVE NVD 15d ago

   ApostropheCMS is an open-source Node.js content management system.

   CVSS 7.5 Fix available CVE-2026-113711 Node.js
2. 13
   CVE NVD 15d ago

   ApostropheCMS is an open-source Node.js content management system.

   CVSS 5.9 Fix available CVE-2026-113710 Node.js
3. 8
   CVE NVD 15d ago

   ApostropheCMS is an open-source Node.js content management system.

   CVSS 4.3 CVE-2026-113671 Node.js
4. 13
   CVE NVD 15d ago

   ApostropheCMS is an open-source Node.js content management system.

   CVSS 5.3 Fix available CVE-2026-113670 Node.js
5. 10
   CVE NVD 15d ago

   ApostropheCMS is an open-source Node.js content management system.

   Fix available CVE-2026-113669 Node.js
6. 13
   CVE NVD 15d ago

   ApostropheCMS is an open-source Node.js content management system.

   CVSS 5.3 Fix available CVE-2026-113668 Node.js
7. 10
   CVE NVD 15d ago

   ApostropheCMS is an open-source Node.js content management system.

   Fix available CVE-2026-113667 Node.js
8. 15
   CVE NVD 15d ago

   ApostropheCMS is an open-source Node.js content management system.

   CVSS 7.1 CVE-2026-113666 Node.js
9. 10
   CVE NVD 15d ago

   ApostropheCMS is an open-source Node.js content management system.

   CVSS 3.7 Fix available CVE-2026-113665 Node.js MongoDB
10. 10
    CVE NVD 15d ago

    ApostropheCMS is an open-source Node.js content management system.

    Fix available CVE-2026-113664 Node.js
11. 13
    CVE NVD 15d ago

    ApostropheCMS is an open-source Node.js content management system.

    CVSS 5.4 Fix available CVE-2026-113662 Node.js
12. 13
    CVE NVD 15d ago

    ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

    CVSS 5.4 Fix available CVE-2026-113661 Node.js
13. 13
    CVE NVD 15d ago

    ApostropheCMS is an open-source Node.js content management system.

    CVSS 4.3 Fix available CVE-2026-113660 Node.js
14. 13
    CVE NVD 15d ago

    ApostropheCMS is an open-source Node.js content management system.

    CVSS 6.1 Fix available CVE-2026-113659 Node.js
15. 20
    CVE NVD 15d ago

    ApostropheCMS is an open-source Node.js content management system.

    CVSS 7.5 Fix available CVE-2026-113658 Node.js
16. 5
    CVE NVD 15d ago

    ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

    CVSS 3.7 CVE-2026-113657 Node.js
17. 13
    CVE NVD 15d ago

    ApostropheCMS is an open-source Node.js content management system.

    CVSS 5.3 Fix available CVE-2026-113656 Node.js
18. 13
    CVE NVD 15d ago

    ApostropheCMS is an open-source Node.js content management system.

    CVSS 4.3 Fix available CVE-2026-113655 Node.js
19. 5
    CVE NVD 15d ago

    ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

    CVE-2026-113654 Node.js
20. 10
    CVE NVD 15d ago

    ApostropheCMS is an open-source Node.js content management system.

    Fix available CVE-2026-113653 Node.js