CVE-2026-113665: ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification.
As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user’s notification.
References
- github.com/advisories/GHSA-vwwx-px9w-crrc
- github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
- github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
- github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0
- github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrc
- nvd.nist.gov/vuln/detail/CVE-2026-113665
Code Behaviors & Features
Detect and mitigate CVE-2026-113665 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →