ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.

Affected: npm: @apostrophecms/import-export

#### 1. Summary The API endpoint `POST /api/v1/@apostrophecms/import-export/clean-export` in `@apostrophecms/import-export` lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying `self.cleanExport(req)` method.

---

#### 2. Affected Files & Endpoints * **Endpoint:** `POST /api/v1/@apostrophecms/import-export/clean-export` * **Route Definition:** `packages/import-export/lib/apiRoutes.js` (lines 32–34) * **Method Implementation:** `packages/import-export/lib/methods/import.js` (lines 1271–1324)

---

#### 3. Root Cause Analysis In `packages/import-export/lib/apiRoutes.js`, the `get.related` handler explicitly validates that the caller is logged in: ```javascript get: { async related(req) { if (!req.user) { throw self.apos.error('forbidden'); } // ... } } ``` In contrast, `post.cleanExport` (as well as `post.overrideDuplicates`) lacks any verification of `req.user`: ```javascript post: { async overrideDuplicates(req) { return self.overrideDuplicates(req); },

async cleanExport(req) { return self.cleanExport(req); // <-- No authentication check } } ``` Because ApostropheCMS does not enforce authentication globally on all `apiRoutes`, omitting an explicit `if (!req.user)` guard allows anonymous requests to pass directly through to the business logic layer.

---

#### 4. Evide…