CVE-2026-113710

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0

Description The self-service password-change endpoint verifies the current password but fails to utilize the login module's failed-attempt counter, throttle, delay, or lockout mechanisms. An attacker with a valid authenticated session can submit repeated guesses for the current password without triggering a lockout or throttle response. If the current password is weak or reused, this could allow an attacker to bypass the current-password check and change the account password, leading to account takeover. This issue occurs at the 'PATCH /api/v1/@apostrophecms/settings/password' endpoint when processing the passwordCurrent variable via the handlePasswordProtectedSubform() function.

Recommendations Update ApostropheCMS to version 4.33.0.