ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits the candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content. This issue is fixed in version 3.7.0.

Source published

20 Oct 2026 17:13:07 UTC

Source modified

20 Oct 2026 19:05:20 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits the candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content. This issue is fixed in version 3.7.0.

Source published

Oct 20, 2026, 5:13:07 PM (timezone not stated)

Source modified

Oct 20, 2026, 7:05:20 PM (timezone not stated)

Observed here

7 Nov 2026 04:34:29 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits the candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content. This issue is fixed in version 3.7.0.

Source published

20 Oct 2026 18:17:19 UTC

Source modified

20 Oct 2026 19:53:10 UTC

Observed here

25 Oct 2026 05:17:18 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

## Summary `@apostrophecms/import-export`'s update-by-key feature lets an imported document carry a `<field>:key` property (for example `slug:key`) whose value is used to find an existing document to update instead of inserting a new one. `getUpdateKey()`/`insertOrUpdateDocWithKey()` (`lib/methods/import.js`) use that value directly as a MongoDB query value with no laundering: ```js const matchingDraftPromise = manager.findForEditing( req.clone({ mode: 'draft' }), { aposMode: 'draft', [updateField]: doc[updateKey] }).toObject(); ``` Archive documents are parsed with EJSON (see `lib/formats/gzip.js`), which revives objects such as `{ $ne: null }` as live values, the same untrusted data source and revival mechanism already fixed once in this module for `findSingletonAposDocId`/`findParkedAposDocId` in GHSA-79qf-vqgc-7xx3. That fix did not touch `insertOrUpdateDocWithKey`, so the identical class of bug survives here: a crafted `"slug:key": { "$ne": null }` entry in an archive's `aposDocs.json` makes the import match (and then update) an existing document the archive's author never actually identified, instead of failing to find a match. ## Impact Reaching this requires only an authenticated session with import access to the target type (the built-in contributor role holds this, matching the precondition of GHSA-79qf-vqgc-7xx3), and no admin interaction. Because the match uses a MongoDB operator instead of an exact value, it is not limited to a document the importer already knows the identifying field of: any existing document the importer has generic edit rights on and that satisfies the operator (which `{ $ne: null }` trivially does for any doc with a non-null value in that field) is a candidate, and Apostrophe's `findForEditing` permission filter, not the update-key logic, is the only thing narrowing which document actually gets matched and overwritten. Live-verified: a contributor-role request importing a document containing `"slug:key": { "$ne": null }` had its content applied to an existing, unrelated draft article, overwriting its title, while the importer never specified that article's real slug. ## Affected versions Confirmed on `main` branch HEAD as of 2026-09-04, `packages/import-export/lib/methods/import.js`. ## Suggested fix Launder `doc[updateKey]` to a plain string (mirroring the fix already applied to `type`/`aposLocale`/`parkedId` in GHSA-79qf-vqgc-7xx3) before using it as a query value, and fall back to the insert path when it is not a usable string.

Source published

20 Oct 2026 18:19:19 UTC

Source modified

20 Oct 2026 18:30:03 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Publisher rating · MODERATE