CVE-2026-113649 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS deployments using @apostrophecms/import-export version 3.7.0 should assess exposure and apply the fix in version 3.7.1 or later. This includes verifying the presence of publication role checks in the import API and reviewing compensating controls for exposed systems. Additionally, defenders should prioritize verifying the presence of publication role checks in the import API and assessing exposure in ApostropheCMS.

Why it matters

The CVE-2026-113649 vulnerability in ApostropheCMS's Import API allows for the bypass of publication roles for protected content, potentially leading to unauthorized publication. Defenders should prioritize verifying the presence of publication role checks in the import API and assessing exposure in ApostropheCMS deployments using @apostrophecms/import-export version 3.7.0. The issue is addressed in version 3.7.1.

• Potential unauthorized publication of protected content
• Bypass of publication roles in the import API
• Missing publish permission checks in the import process
• Verification of publication role checks in the import API is required

Technical summary

The import API in @apostrophecms/import-export version 3.7.0 does not perform the normal publish permission check or beforePublish checks, allowing for unauthorized publication of protected content. The import gate in canImportOrExport() checks the type's import configuration and view permission. However, the write helpers then call document-manager insert/update directly, including operations on published variants, without the necessary publication role checks. This issue is addressed in version 3.7.1, where the necessary checks are added to prevent unauthorized publication.

Defensive priority

Defenders should prioritize verifying the presence of publication role checks in the import API and assessing exposure in ApostropheCMS deployments.

Recommended defensive actions

• Verify the presence of publication role checks in the import API
• Assess exposure in ApostropheCMS deployments using @apostrophecms/import-export version 3.7.0
• Apply the fix in @apostrophecms/import-export version 3.7.1 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The source corpus establishes that the import API in @apostrophecms/import-export version 3.7.0 bypasses publication roles for protected content. The issue is addressed in version 3.7.1. However, current exploitability and impact require maintainer validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.