CVE-2026-113648 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS deployments using the `@apostrophecms/import-export` package should assess exposure and apply patches or compensating controls to prevent unauthorized access to the `cleanExport` route.

Why it matters

The vulnerability in the `@apostrophecms/import-export` package allows unauthenticated access to the `cleanExport` route, potentially leading to unauthorized data access or disruption of import/export operations. Defenders should prioritize verifying exposure and applying patches or compensating controls.

• Potential unauthorized access to sensitive data or functionality via the `cleanExport` route.
• Possible disruption of data import/export operations.
• Need for verification of `@apostrophecms/import-export` package version and exposure to unauthenticated access.

Technical summary

The `@apostrophecms/import-export` package has a vulnerability in the `cleanExport` route, which lacks authentication and authorization checks. This allows unauthenticated clients to invoke the route and trigger the underlying `self.cleanExport(req)` method. The vulnerability is caused by a missing authentication check in the `cleanExport` route, which is defined in `packages/import-export/lib/apiRoutes.js`. The route is accessible via `POST /api/v1/@apostrophecms/import-export/clean-export`. The vulnerability can be mitigated by applying patches or compensating controls to prevent unauthorized access.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for the `@apostrophecms/import-export` package, particularly for versions prior to 3.7.1, and assess the impact of unauthenticated access to the `cleanExport` route.

Recommended defensive actions

• Verify the version of `@apostrophecms/import-export` in use and apply patches to upgrade to version 3.7.1 or later if necessary.
• Assess the exposure of the `cleanExport` route to unauthenticated access and implement compensating controls if patches cannot be applied immediately.
• Monitor for any suspicious activity related to the `cleanExport` route.
• Review the configuration of the `@apostrophecms/import-export` package to ensure that it is properly secured.
• Check for any existing compensating controls that may mitigate the vulnerability.
• Perform a thorough review of the system to identify any potential entry points for attackers.
• Document the findings and provide recommendations for remediation.

Evidence notes

The source corpus provides details on the vulnerability in the `@apostrophecms/import-export` package, specifically the lack of authentication and authorization checks in the `cleanExport` route. However, the corpus does not provide explicit information on exploitation or specific impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.