CVE-2026-113710 apostrophecms CVE debrief

Who should care

ApostropheCMS administrators and users with access to the password-change endpoint should assess exposure and prioritize verification of endpoint security. This includes reviewing current deployments, understanding the vulnerability's impact, and taking steps to mitigate potential attacks. Operators, platform administrators, and security teams must work together to ensure proper remediation and minimize potential risks.

Why it matters

ApostropheCMS users should assess exposure and prioritize verification of password-change endpoint security due to a vulnerability allowing unlimited current-password guessing.

• Defenders must verify password-change endpoint security to prevent potential guessing attacks
• ApostropheCMS administrators should assess exposure and prioritize upgrades to version 4.33.0 or later

Technical summary

ApostropheCMS versions < 4.33.0 have a vulnerability in the self-service password-change endpoint, allowing unlimited current-password guessing without lockout or throttle response. This issue arises from the endpoint's failure to utilize the login module's failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. The vulnerability is fixed in version 4.33.0, which implements proper throttling and lockout mechanisms to prevent such attacks.

Defensive priority

Defenders should verify password-change endpoint security, especially for ApostropheCMS versions < 4.33.0.

Recommended defensive actions

• Verify ApostropheCMS version and upgrade to 4.33.0 or later if necessary
• Assess exposure of password-change endpoint to potential guessing attacks
• Implement additional security measures to prevent unlimited current-password guessing
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in ApostropheCMS. The NVD entry is currently UNCHANGED. Evidence from the source item indicates that ApostropheCMS versions prior to 4.33.0 are affected, and defenders should verify password-change endpoint security to prevent potential guessing attacks. The CVE Program record and NVD detail page offer additional context on the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.