CVE-2026-113662

Name of the Vulnerable Software and Affected Versions @apostrophecms/import-export versions prior to 3.7.0

Description An authenticated user with import access to a target type can manipulate the update-by-key feature to modify documents they did not explicitly identify. The getUpdateKey() and insertOrUpdateDocWithKey() functions in lib/methods/import.js use the value of an update-key property directly as a MongoDB query value without proper sanitization. Because archive documents are parsed with EJSON, an attacker can supply a MongoDB operator, such as { $ne: null }, instead of a plain string. This causes the import query to match and overwrite an existing document that the user has generic edit permissions for, rather than failing to find a match or inserting a new document. The findForEditing permission filter limits the scope of affected documents, preventing the overwrite of arbitrary protected content.

Recommendations Update @apostrophecms/import-export to version 3.7.0.