CVE-2026-113659 apostrophecms CVE debrief

Who should care

ApostropheCMS users, especially those with admin bundles accessible to authenticated users, should assess exposure and prioritize verification of their systems. This includes reviewing system configurations, verifying versions, and ensuring that appropriate mitigations are in place. Additionally, operators, platform administrators, vulnerability management teams, and security teams should be aware of the potential impacts and take necessary actions to rem

Why it matters

ApostropheCMS users should assess exposure and prioritize verification of their systems, especially those with admin bundles accessible to authenticated users, due to a potential vulnerability allowing script execution in victim sessions.

• Potential script execution in authenticated user sessions
• Prototype mutation allowing for DOM sink exploitation
• Verification of system exposure and upgrade to fixed version required

Technical summary

The vulnerability exists in ApostropheCMS versions prior to 4.33.0, allowing an unauthenticated attacker to send a crafted link that can mutate the browser prototype when an authenticated victim loads a page. This can potentially lead to script execution in the victim's session. The issue arises from the parser accepting special keys like __proto__, constructor, and prototype path keys, which can lead to browser prototype mutation and an unsafe DOM sink. The vulnerability is fixed in ApostropheCMS version 4.33.0, and users should assess exposure and prioritize verification of their systems, especially those with admin bundles accessible to authenticated users.

Defensive priority

Medium priority for ApostropheCMS users, especially those with admin bundles accessible to authenticated users

Recommended defensive actions

• ApostropheCMS users should verify if their systems are using a version prior to 4.33.0
• Authenticated users with access to admin bundles should be cautious when loading pages with links from untrusted sources
• Users should prioritize upgrading to ApostropheCMS version 4.33.0 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the exact scope of affected systems and potential impact require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.