Search
Find a vulnerability
Search criteria
4 vulnerabilities found for form by @apostrophecms
CVE-2026-113667 (GCVE-0-2026-113667)
Vulnerability from nvd – Published: 2026-10-20 17:33 – Updated: 2026-10-20 17:33
VLAI
EPSS
VEX
Title
ApostropheCMS: CAPTCHA response token not URL-encoded
Summary
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated form or login flows; automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure is not established. This issue is fixed in Form 1.5.5, login-recaptcha 1.2.1, and login-hcaptcha 1.3.0.
Severity
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/apostrophecms/apostrophe/secur… | x_refsource_CONFIRM |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/relea… | x_refsource_MISC |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| apostrophecms | apostrophe |
Affected:
< 4.33.0
|
|
| @apostrophecms | form |
Affected:
< 1.5.5
|
|
| @apostrophecms | login-hcaptcha |
Affected:
< 1.3.0
|
|
| @apostrophecms | login-recaptcha |
Affected:
< 1.2.1
|
{
"containers": {
"cna": {
"affected": [
{
"product": "apostrophe",
"vendor": "apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 4.33.0"
}
]
},
{
"product": "form",
"vendor": "@apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.5"
}
]
},
{
"product": "login-hcaptcha",
"vendor": "@apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 1.3.0"
}
]
},
{
"product": "login-recaptcha",
"vendor": "@apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated form or login flows; automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure is not established. This issue is fixed in Form 1.5.5, login-recaptcha 1.2.1, and login-hcaptcha 1.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T17:33:28.418Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-44qr-rrjg-2cqq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-44qr-rrjg-2cqq"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
},
{
"name": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5"
}
],
"source": {
"advisory": "GHSA-44qr-rrjg-2cqq",
"discovery": "UNKNOWN"
},
"title": "ApostropheCMS: CAPTCHA response token not URL-encoded"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-113667",
"datePublished": "2026-10-20T17:33:28.418Z",
"dateReserved": "2026-10-20T14:27:46.642Z",
"dateUpdated": "2026-10-20T17:33:28.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113656 (GCVE-0-2026-113656)
Vulnerability from nvd – Published: 2026-10-20 16:49 – Updated: 2026-10-20 16:49
VLAI
EPSS
VEX
Title
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
Summary
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.
Severity
5.3 (Medium)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/apostrophecms/apostrophe/secur… | x_refsource_CONFIRM |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/relea… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| apostrophecms | apostrophe |
Affected:
< 4.33.0
|
|
| @apostrophecms | form |
Affected:
< 1.5.5
|
{
"containers": {
"cna": {
"affected": [
{
"product": "apostrophe",
"vendor": "apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 4.33.0"
}
]
},
{
"product": "form",
"vendor": "@apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:49:36.239Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-89mh-mm8c-mv7f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-89mh-mm8c-mv7f"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
},
{
"name": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5"
}
],
"source": {
"advisory": "GHSA-89mh-mm8c-mv7f",
"discovery": "UNKNOWN"
},
"title": "ApostropheCMS: Unauthenticated unbounded multipart upload \u2192 disk-exhaustion DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-113656",
"datePublished": "2026-10-20T16:49:36.239Z",
"dateReserved": "2026-10-20T14:27:46.641Z",
"dateUpdated": "2026-10-20T16:49:36.239Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113667 (GCVE-0-2026-113667)
Vulnerability from cvelistv5 – Published: 2026-10-20 17:33 – Updated: 2026-10-20 17:33
VLAI
EPSS
VEX
Title
ApostropheCMS: CAPTCHA response token not URL-encoded
Summary
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated form or login flows; automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure is not established. This issue is fixed in Form 1.5.5, login-recaptcha 1.2.1, and login-hcaptcha 1.3.0.
Severity
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/apostrophecms/apostrophe/secur… | x_refsource_CONFIRM |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/relea… | x_refsource_MISC |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| apostrophecms | apostrophe |
Affected:
< 4.33.0
|
|
| @apostrophecms | form |
Affected:
< 1.5.5
|
|
| @apostrophecms | login-hcaptcha |
Affected:
< 1.3.0
|
|
| @apostrophecms | login-recaptcha |
Affected:
< 1.2.1
|
{
"containers": {
"cna": {
"affected": [
{
"product": "apostrophe",
"vendor": "apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 4.33.0"
}
]
},
{
"product": "form",
"vendor": "@apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.5"
}
]
},
{
"product": "login-hcaptcha",
"vendor": "@apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 1.3.0"
}
]
},
{
"product": "login-recaptcha",
"vendor": "@apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated form or login flows; automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure is not established. This issue is fixed in Form 1.5.5, login-recaptcha 1.2.1, and login-hcaptcha 1.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T17:33:28.418Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-44qr-rrjg-2cqq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-44qr-rrjg-2cqq"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
},
{
"name": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5"
}
],
"source": {
"advisory": "GHSA-44qr-rrjg-2cqq",
"discovery": "UNKNOWN"
},
"title": "ApostropheCMS: CAPTCHA response token not URL-encoded"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-113667",
"datePublished": "2026-10-20T17:33:28.418Z",
"dateReserved": "2026-10-20T14:27:46.642Z",
"dateUpdated": "2026-10-20T17:33:28.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113656 (GCVE-0-2026-113656)
Vulnerability from cvelistv5 – Published: 2026-10-20 16:49 – Updated: 2026-10-20 16:49
VLAI
EPSS
VEX
Title
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
Summary
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.
Severity
5.3 (Medium)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/apostrophecms/apostrophe/secur… | x_refsource_CONFIRM |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/relea… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| apostrophecms | apostrophe |
Affected:
< 4.33.0
|
|
| @apostrophecms | form |
Affected:
< 1.5.5
|
{
"containers": {
"cna": {
"affected": [
{
"product": "apostrophe",
"vendor": "apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 4.33.0"
}
]
},
{
"product": "form",
"vendor": "@apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:49:36.239Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-89mh-mm8c-mv7f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-89mh-mm8c-mv7f"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
},
{
"name": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5"
}
],
"source": {
"advisory": "GHSA-89mh-mm8c-mv7f",
"discovery": "UNKNOWN"
},
"title": "ApostropheCMS: Unauthenticated unbounded multipart upload \u2192 disk-exhaustion DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-113656",
"datePublished": "2026-10-20T16:49:36.239Z",
"dateReserved": "2026-10-20T14:27:46.641Z",
"dateUpdated": "2026-10-20T16:49:36.239Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}