ApostropheCMS: Missing Authentication in `cleanExport` Route

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.

Source published

20 Oct 2026 16:07:49 UTC

Source modified

23 Oct 2026 01:52:13 UTC

Observed here

23 Oct 2026 16:01:20 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.

Source published

Oct 20, 2026, 4:07:49 PM (timezone not stated)

Source modified

Oct 23, 2026, 1:52:13 AM (timezone not stated)

Observed here

7 Nov 2026 04:34:04 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.

Source published

20 Oct 2026 17:17:35 UTC

Source modified

23 Oct 2026 02:16:55 UTC

Observed here

25 Oct 2026 05:17:18 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

#### 1. Summary The API endpoint `POST /api/v1/@apostrophecms/import-export/clean-export` in `@apostrophecms/import-export` lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying `self.cleanExport(req)` method. --- #### 2. Affected Files & Endpoints * **Endpoint:** `POST /api/v1/@apostrophecms/import-export/clean-export` * **Route Definition:** `packages/import-export/lib/apiRoutes.js` (lines 32–34) * **Method Implementation:** `packages/import-export/lib/methods/import.js` (lines 1271–1324) --- #### 3. Root Cause Analysis In `packages/import-export/lib/apiRoutes.js`, the `get.related` handler explicitly validates that the caller is logged in: ```javascript get: { async related(req) { if (!req.user) { throw self.apos.error('forbidden'); } // ... } } ``` In contrast, `post.cleanExport` (as well as `post.overrideDuplicates`) lacks any verification of `req.user`: ```javascript post: { async overrideDuplicates(req) { return self.overrideDuplicates(req); }, async cleanExport(req) { return self.cleanExport(req); // <-- No authentication check } } ``` Because ApostropheCMS does not enforce authentication globally on all `apiRoutes`, omitting an explicit `if (!req.user)` guard allows anonymous requests to pass directly through to the business logic layer. --- #### 4. Evidence When sending an unauthenticated POST request with the site’s CSRF cookie (issued to any visitor on `GET /`), the request bypasses access control entirely and executes `self.cleanExport(req)`, as demonstrated by the server stack trace: ```text at Object.cleanExport (.../packages/import-export/lib/methods/import.js) at .../packages/apostrophe/modules/@apostrophecms/module/index.js:193:30 ``` This confirms that execution directly reaches the core import-export handler without an authenticated session. --- #### 5. Impact 1. **Broken Access Control:** Unauthenticated users can invoke cleanup operations and delete temporary export files and artifacts stored on the server. 2. **Unauthorized State Mutation:** The endpoint allows modifying job records in the database via `req.body.jobId` (forcing them to `ended: true, status: 'completed'`) and dismissing notifications via `req.body.notificationId` without verifying whether the resources belong to the requesting caller. --- #### 6. Suggested Remediation (Patch) Enforce an authentication check in `packages/import-export/lib/apiRoutes.js` before executing the underlying methods: ```diff --- a/packages/import-export/lib/apiRoutes.js +++ b/packages/import-export/lib/apiRoutes.js @@ -26,10 +26,16 @@ module.exports = self => { get: { ... }, post: { async overrideDuplicates(req) { + if (!req.user) { + throw self.apos.error('forbidden'); + } return self.overrideDuplicates(req); }, async cleanExport(req) { + if (!req.user) { + throw self.apos.error('forbidden'); + } return self.cleanExport(req); } } ```

Source published

21 Oct 2026 17:13:28 UTC

Source modified

21 Oct 2026 17:28:21 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Publisher rating · LOW