CVE-2026-53609: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

July 31, 2026

apos.util.set() traverses dot-notation paths without sanitizing __proto__, allowing an authenticated editor to write arbitrary values to Object.prototype via the $pullAll patch operator.

A confirmed gadget in publicApiCheck() causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process.

References

github.com/advisories/GHSA-6h5j-32cf-4253
github.com/apostrophecms/apostrophe/commit/5a88e9630cbbdde33154ef8abe7557ddf7be418b
github.com/apostrophecms/apostrophe/pull/5464
github.com/apostrophecms/apostrophe/security/advisories/GHSA-6h5j-32cf-4253
nvd.nist.gov/vuln/detail/CVE-2026-53609

Code Behaviors & Features

Detect and mitigate CVE-2026-53609 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →