ApostropheCMS CVE-2026-112956

Exploitation requires: (1) the @apostrophecms/import-export module installed and in use; (2) at least one import-enabled localized document type; and (3) an authenticated ApostropheCMS account with contributor-level draft editing authority. The attacker leverages the duplicate-import continuation step, which accepts a client-supplied replacement choice without binding it to a server-side analysis owned by that user or re-authorizing the canonical target. Limiting factors that reduce real-world risk: a valid logged-in low-privilege account is mandatory (not anonymous/remote-unauthenticated), the import-export feature and a localized, import-enabled type must be configured, and impact is confined to unauthorized modification of published content rather than data disclosure or denial of service.

This is a medium-severity authorization flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) rather than a top-priority emergency. The vector shows network reach and low attack complexity, but PR:L means exploitation requires an authenticated account - specifically a contributor with draft editing authority - which sharply narrows the threat population to users who already have a foothold inside the CMS. Impact is integrity-only (C:N/A:N): the attacker can cross the draft/published boundary and replace a published document they should not control, but cannot read protected data or cause outage. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so there is no public exploit identified at time of analysis and no signal of active or widespread exploitation. Notably, the vendor advisory itself states the finding rests on remediation (code/patch) review rather than a repeated end-to-end reproduction, so even the exploitability is vendor-inferred rather than demonstrated - treat the integrity impact as plausible but not independently proven. Net: a legitimate insider-privilege-escalation/authorization issue worth patching during normal cycles, not a drop-everything remote-unauthenticated threat.

A logged-in contributor who only has draft editing authority uses the import-export module's duplicate-import continuation flow and submits a client-controlled replacement choice that points at a published document. Because the server does not bind that choice to the user's own server-side analysis or re-authorize the canonical target, the contributor overwrites published content they were never permitted to alter. No public exploit code exists; exploitation requires a valid low-privilege account and the import-export module to be in use.