{"id":"EUVD-2026-105107","enisaUuid":"6012101a-b5b9-39b7-8882-4c51ec27c643","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather than a repeated end-to-end reproduction. This issue is fixed in version 3.7.1.","datePublished":"Oct 20, 2026, 3:57:27 PM","dateUpdated":"Oct 20, 2026, 4:15:02 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jf5h-36mg-rp6x\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1\n","aliases":"CVE-2026-112956\nGHSA-jf5h-36mg-rp6x\n","assigner":"GitHub_M","epss":0.34,"enisaIdProduct":[{"id":"2db1e370-e1fa-3036-ab63-f4a076861f91","product":{"name":"mport-export","vendor":{"name":"@apostrophecms"}},"product_version":"\u003c 3.7.1"},{"id":"dd37884d-4032-3419-9763-78f086c0f3e6","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.34.0"}],"enisaIdVendor":[{"id":"30f88012-77ec-31e0-8d52-28a0be1a9868","vendor":{"name":"@apostrophecms"}},{"id":"acef2de6-48e8-3d46-864d-2610fc1c9865","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"26310f30-f22f-331c-a6c1-3179a8c394f3","vulnerability":{"id":"CVE-2026-112956","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather than a repeated end-to-end reproduction. This issue is fixed in version 3.7.1.","datePublished":"Oct 20, 2026, 3:57:27 PM","dateUpdated":"Oct 20, 2026, 4:15:02 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jf5h-36mg-rp6x\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1\n","enisa_id":"EUVD-2026-105107\n","assigner":"GitHub_M","epss":0.34,"dataProcessed":"Oct 29, 2026, 7:14:24 AM","vulnerabilityProduct":[{"id":"bb9bb98f-1028-35dc-9760-9423f0a05ea2","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.34.0"},{"id":"e57e1c8d-823a-3bf5-9dec-21f111174712","product":{"name":"mport-export","vendor":{"name":"@apostrophecms"}},"product_version":"\u003c 3.7.1"}],"vulnerabilityVendor":[{"id":"0511f573-e0d1-3a33-b29a-f86892b9a9c7","vendor":{"name":"@apostrophecms"}},{"id":"faed85b5-92b2-3f5a-bbb9-730fac0a5f65","vendor":{"name":"apostrophecms"}}]}},{"id":"b7211a3f-0387-32b7-84aa-b2e942d5e62b","vulnerability":{"id":"GHSA-jf5h-36mg-rp6x","description":"ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content","datePublished":"Oct 21, 2026, 4:59:19 PM","dateUpdated":"Oct 21, 2026, 4:59:19 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jf5h-36mg-rp6x\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112956\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1\n","enisa_id":"EUVD-2026-105107\n","aliases":"GHSA-jf5h-36mg-rp6x\nCVE-2026-112956\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}