{"id":"EUVD-2026-105214","enisaUuid":"b7610b59-f7f6-34a9-b02a-59d0bc251fdd","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.","datePublished":"Oct 20, 2026, 5:25:44 PM","dateUpdated":"Oct 20, 2026, 5:43:12 PM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-j5rq-xfvr-p969\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/db-connect@1.1.0\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0\n","aliases":"CVE-2026-113666\nGHSA-j5rq-xfvr-p969\n","assigner":"GitHub_M","epss":0.44,"enisaIdProduct":[{"id":"df65c1a0-b47f-308f-b9cd-f5aa62a7ee70","product":{"name":"db-connect","vendor":{"name":"@apostrophecms"}},"product_version":"\u003c 1.1.0"},{"id":"e60edab6-1b80-3f97-a8a4-2d014f89fb1f","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"}],"enisaIdVendor":[{"id":"9fd2b05e-ba7c-336f-9f7e-d24433c0dcc7","vendor":{"name":"apostrophecms"}},{"id":"e1168fcf-7567-39a9-bd84-4d8bc83d74b4","vendor":{"name":"@apostrophecms"}}],"enisaIdVulnerability":[{"id":"908e8d3c-dcda-3b18-a60a-0b51ab3527a8","vulnerability":{"id":"CVE-2026-113666","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.","datePublished":"Oct 20, 2026, 5:25:44 PM","dateUpdated":"Oct 20, 2026, 5:43:12 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-j5rq-xfvr-p969\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/db-connect@1.1.0\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0\n","enisa_id":"EUVD-2026-105214\n","assigner":"GitHub_M","epss":0.44,"dataProcessed":"Nov 6, 2026, 7:15:43 AM","vulnerabilityProduct":[{"id":"6f7d5835-3d46-3bbb-9d4b-f88c9ed69c94","product":{"name":"db-connect","vendor":{"name":"@apostrophecms"}},"product_version":"\u003c 1.1.0"},{"id":"ec189c9c-1cf2-3bff-9364-e4ef04006005","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"}],"vulnerabilityVendor":[{"id":"76e26d18-9a12-3daf-8edb-08d73574f1d8","vendor":{"name":"apostrophecms"}},{"id":"9633fe78-0cba-3285-98aa-1fd88b7f5d57","vendor":{"name":"@apostrophecms"}}]}},{"id":"9fb4cded-95b3-3fc1-b576-1551c3779325","vulnerability":{"id":"GHSA-j5rq-xfvr-p969","description":"ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service","datePublished":"Oct 20, 2026, 6:03:50 PM","dateUpdated":"Oct 20, 2026, 6:03:50 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-j5rq-xfvr-p969\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/db-connect@1.1.0\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0\n","enisa_id":"EUVD-2026-105214\n","aliases":"CVE-2026-113666\nGHSA-j5rq-xfvr-p969\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}