CVE-2026-112956

CVE-2026-112956 · ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather than a repeated end-to-end reproduction. This issue is fixed in version 3.7.1.

CVSS 6.5 · Средний · EPSS 0,3% · Есть исправление

Опубликовано

2026-10-20T15:57:27.287Z

Обновлено

2026-10-20T16:15:02.976Z

Стек: node

Проверьте свой сервер →