CVE-2026-39857

Prior to ApostropheCMS 4.33.0 and import-export 3.7.0, import routes invoke bigUploadMiddleware without an early authorize callback. Unauthenticated requests can perform upload initialization, chunk storage, temporary processing and attacker-declared cleanup work before the later user check rejects the import.

ApostropheCMS prior to 4.33.0 has a self-service password-change endpoint that verifies the current password but does not use the login module's failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. This is fixed in version 4.33.0.

ApostropheCMS prior to 4.33.0 has its core page REST API read full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by _id/slug. This is fixed in version 4.33.0.

ApostropheCMS prior to 4.33.0 has a REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) that does not apply the publicApiCheckAsync gate enforced by other read routes. An unauthenticated caller can query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read API is otherwise supposed to gate. This is fixed in version 4.33.0.

In the CAPTCHA integrations (Form, login-recaptcha, login-hcaptcha) for ApostropheCMS, the user-supplied response token is interpolated unencoded into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated forms or login flows. Automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure has not been established.

Prior to db-connect 1.1.0 and ApostropheCMS 4.33.0, an account with view-draft access can submit a projection exclusion path that traverses a constructor prototype chain to a shared prototype member when a SQLite, PostgreSQL or multipostgres adapter is used. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected.

In the import-export module of ApostropheCMS before 3.7.0, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content.

In ApostropheCMS before 4.33.0, the exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. The issue is fixed in version 4.33.0.

Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibling ranks without create authorization on that parent. The bypass is limited to sibling ordering rather than arbitrary content modification, confidentiality loss, or creation of the restricted nesting.

Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but password hashes are stored separately and are not affected.