ApostropheCMS CVE-2026-113648

The vulnerable route is POST /api/v1/@apostrophecms/import-export/clean-export in the @apostrophecms/import-export module prior to 3.7.1, which performs no authentication or authorization check (CWE-306). The only prerequisite to invoke the route is possession of the standard CSRF cookie, which any client obtains simply by visiting the site - so an anonymous user can reach the endpoint. However, meaningful impact is tightly limited: cleanExport only affects a specific import identified by a random pending-import ID that is shown only to the user who uploaded it, so an attacker can realistically only interfere with an import whose ID they already know or can observe. Further limiting factors: the site must have the optional import-export module installed and an import must be pending; impact is confined to discarding pending import files and marking an import job completed (no data disclosure, no service outage).

This is a low real-world priority despite being a missing-authentication flaw (CWE-306). The input CVSS 3.1 base score is only 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting no confidentiality or availability impact and only partial integrity impact. No EPSS probability was provided, the CVE is not listed in CISA KEV, and no public exploit was supplied - so there is no signal of active or probable exploitation. CONFLICT TO VERIFY: the CVSS vector encodes PR:L (privileges required), yet the description and the CWE-306 classification explicitly state the clean-export route 'lacks authentication and authorization checks' and can be called by 'unauthenticated anonymous users' who merely hold the standard CSRF cookie - the vector's PR:L appears inconsistent with the description, which supports PR:N. The high attack complexity (AC:H) is well justified by the vendor changeset: exploitation is meaningfully constrained because the pending import's ID is random and only shown to the uploading user, so an attacker can only interfere with an import they can already identify. Net effect: a genuine authorization gap but with limited, hard-to-target impact - routine-patch priority, not an emergency.

An attacker visits the ApostropheCMS site to obtain the standard CSRF cookie, then sends an unauthenticated POST to /api/v1/@apostrophecms/import-export/clean-export, triggering self.cleanExport(req). If the attacker knows (or can guess/observe) a victim's random pending-import ID, they can discard that user's pending import files and mark the import job as completed. No public exploit code was identified at time of analysis; the fixing commits are public but do not constitute a weaponized PoC.