PT-2026-76776 · Unknown · Apostrophe Cms
CVE-2026-71553
·
Published
2026-08-17
·
Updated
2026-09-03
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
ApostropheCMS versions prior to 4.32.1
Description
An authenticated editor can cause a persistent process-wide denial of service until a restart occurs. This happens because the PATCH '/api/v1/article/:id' endpoint accepts the inherited path
toString.call and passes it through the utility module to the apos.util.set() and apos.util.get() functions, allowing the call property of the shared Object.prototype.toString function to be overwritten.Recommendations
Update to a version later than 4.32.0.
Exploit
Fix
DoS
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apostrophe Cms