CVE-2026-113665

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0

Description The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying if the requester is authenticated or owns the target notification. An unauthenticated attacker with a valid notification ID can modify or permanently delete notifications belonging to other users. This occurs because the patch() and delete() functions in the notification module fail to implement authentication and ownership checks, unlike the GET route which correctly validates the user session.

Recommendations Update to version 4.33.0. As a temporary mitigation, restrict access to the notification module REST endpoints to prevent unauthorized PATCH and DELETE requests.