CVE-2026-33877 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS instances, particularly those with the passwordReset option enabled, should assess exposure and implement mitigations to prevent enumeration attempts.

Why it matters

Defenders should prioritize verifying exposure and implementing compensating controls, as the vulnerability allows enumeration of valid accounts for credential stuffing or targeted phishing in ApostropheCMS instances with the passwordReset option enabled.

• Enumeration of valid accounts for use in credential stuffing or targeted phishing.
• Potential for automated attacks using valid account information.
• Need for verification of exposure and implementation of compensating controls.

Technical summary

The password reset endpoint in ApostropheCMS versions 4.28.0 and prior is vulnerable to a timing side-channel attack, allowing unauthenticated enumeration of usernames and emails. The endpoint's response time differs between existing and non-existing users, enabling automated enumeration. This issue is fixed in version 4.29.0. Only instances with the passwordReset option enabled are affected. The vulnerability allows enumeration of valid accounts for use in credential stuffing or targeted phishing. Defenders should prioritize verifying exposure and implementing compensating controls.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls, as the vulnerability allows enumeration of valid accounts for credential stuffing or targeted phishing.

Recommended defensive actions

• Verify if ApostropheCMS instances have the passwordReset option enabled and are running versions 4.28.0 or prior.
• Implement compensating controls, such as rate limiting and IP blocking, to mitigate enumeration attempts.
• Upgrade to version 4.29.0 or later to fix the vulnerability.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability is confirmed in ApostropheCMS versions 4.28.0 and prior, with the passwordReset option enabled. Evidence is based on the CVE Program record and NVD vulnerability detail page. Defenders should verify exposure and review compensating controls. The CVE record was published on 2026-04-15T20:16:35.517Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.