CVE-2026-113665 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS deployments should assess exposure and apply the patch in version 4.33.0 if vulnerable. This includes operators managing ApostropheCMS instances, platform administrators, vulnerability management teams, and security teams monitoring for potential unauthorized notification modifications or deletions. Verification of ApostropheCMS installations for potential exposure is crucial, along with prioritization of patching to

Why it matters

CVE-2026-113665 is a low-severity vulnerability in ApostropheCMS that allows an unauthenticated attacker to modify or delete user notifications. Defenders should verify exposure, prioritize patching, and monitor for suspicious activity.

• Verification of ApostropheCMS installations for potential exposure
• Potential unauthorized modification or deletion of user notifications
• Prioritization of patching to version 4.33.0
• Monitoring for suspicious notification activity

Technical summary

The notification module in ApostropheCMS exposes PATCH and DELETE REST endpoints that allow an unauthenticated attacker to modify or permanently delete another user's notification if a valid notification ID is obtained. This issue allows attackers to tamper with user notifications without proper authentication, potentially leading to unauthorized modifications or deletions. Defenders should focus on verifying exposure of ApostropheCMS installations to this vulnerability and apply the patch in version 4.33.0 if vulnerable. The fix addresses the authentication oversight in the notification module, ensuring that only authorized users can modify or delete notifications.

Defensive priority

Defenders should prioritize verifying exposure of ApostropheCMS installations to this vulnerability and apply the patch in version 4.33.0 if vulnerable.

Recommended defensive actions

• Verify if ApostropheCMS installations are exposed to this vulnerability
• Apply the patch in version 4.33.0 if vulnerable
• Monitor for potential unauthorized notification modifications or deletions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix in ApostropheCMS version 4.33.0. However, additional information on potential exploitation or affected deployments is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.