{"id":"EUVD-2026-36590","enisaUuid":"1cc3c858-e584-3af2-9c5d-f7a7f2503927","description":"ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator. A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process. As of time of publication, no known patched versions are available.","datePublished":"Jun 12, 2026, 8:59:25 PM","dateUpdated":"Jun 15, 2026, 6:29:55 PM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-6h5j-32cf-4253\n","aliases":"CVE-2026-53609\nGHSA-6h5j-32cf-4253\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"7696e008-cd22-32cd-9fbf-4ea0bc3b2f7a","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"≤ 4.30.0"}],"enisaIdVendor":[{"id":"824d1aed-7796-312a-bd0e-c2ef24351d6a","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"1cc28cec-3f2c-30fc-86d2-f506d4674986","vulnerability":{"id":"GHSA-6h5j-32cf-4253","description":"Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass","datePublished":"Jul 31, 2026, 9:49:25 PM","dateUpdated":"Jul 31, 2026, 9:49:25 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-6h5j-32cf-4253\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53609\nhttps://github.com/apostrophecms/apostrophe/pull/5464\nhttps://github.com/apostrophecms/apostrophe/commit/5a88e9630cbbdde33154ef8abe7557ddf7be418b\nhttps://github.com/apostrophecms/apostrophe\n","enisa_id":"EUVD-2026-36590\n","aliases":"CVE-2026-53609\nGHSA-6h5j-32cf-4253\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"6f3926f8-8151-3670-9196-bb22759b8cbf","vulnerability":{"id":"CVE-2026-53609","description":"ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator. A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process. As of time of publication, no known patched versions are available.","datePublished":"Jun 12, 2026, 8:59:25 PM","dateUpdated":"Jun 15, 2026, 6:29:55 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-6h5j-32cf-4253\n","enisa_id":"EUVD-2026-36590\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Nov 7, 2026, 7:20:34 AM","vulnerabilityProduct":[{"id":"5073dca8-eea9-3ab0-8a11-4a2fb5b46a0c","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"≤ 4.30.0"}],"vulnerabilityVendor":[{"id":"ffabbc2b-4483-3cae-bb68-a3f0523d7ad2","vendor":{"name":"apostrophecms"}}]}}],"enisaIdAdvisory":[]}