CVE-2026-112956 apostrophecms CVE debrief

Who should care

Defenders of ApostropheCMS systems, specifically those using @apostrophecms/import-export version 3.7.0 or earlier, should assess exposure and apply patches. They should verify configurations to prevent exploitation and review compensating controls for exposed systems while remediation is scheduled and verified. Security teams and operators managing ApostropheCMS should prioritize this vulnerability and take immediate action to secure their systems.

Why it matters

CVE-2026-112956 allows contributors to overwrite published content in ApostropheCMS due to a flaw in the @apostrophecms/import-export package. Defenders should assess exposure, apply patches, and verify configurations to prevent exploitation.

• Published content can be overwritten by contributors without proper authorization
• Content integrity and authenticity are at risk
• Defenders need to verify and apply patches to prevent exploitation

Technical summary

The overrideDuplicates() continuation in @apostrophecms/import-export accepts client-supplied replacement choices, allowing contributors to overwrite published content. This flaw in the @apostrophecms/import-export package, version 3.7.0 or earlier, permits unauthorized published-content replacement. The importer, gzip extractor, import permission gate, and core permission implementation have no differences between that release tag and the reviewed main. Current exploitability and impact therefore still require maintainer validation.

Defensive priority

Assess and apply patches for @apostrophecms/import-export version 3.7.0 or earlier; verify inventory and configurations.

Recommended defensive actions

• Assess @apostrophecms/import-export version and apply patches if necessary
• Verify inventory of systems using @apostrophecms/import-export
• Review configurations for proper permission settings
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The review was based on package @apostrophecms/import-export version 3.7.0 and commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce. Current main reviewed was 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. No end-to-end reproductions were repeated against the latest release or tested on a deployed site.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.