CVE-2026-53609

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.30.1

Description A prototype pollution issue exists in the apos.util.set() function, which traverses dot-notation paths without sanitizing the proto property. This allows an authenticated editor to write arbitrary values to Object.prototype using the $pullAll patch operator. A gadget in the publicApiCheck() function enables this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request for the duration of the Node.js process lifetime.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.