ApostropheCMS CVE-2026-113659

Exploitation requires the victim to be an authenticated ApostropheCMS user whose page loads the admin bundle (editors/administrators), and that victim must open the attacker-supplied crafted link so apos.http.parseQuery processes the hostile query string containing __proto__, constructor, or prototype path keys. The attacker themselves needs no account (PR:N). Key limiting factors: UI:R - the attack fails without the victim actively loading the link; the victim must have an active authenticated admin-context session; and anonymous/front-end-only visitors are explicitly not affected because they do not load the admin context. Fixed in 4.33.0, so only pre-4.33.0 installations with admin users are exposed.

This is a medium-severity (CVSS 6.1) reflected/DOM cross-site scripting issue driven by client-side prototype pollution in ApostropheCMS's apos.http.parseQuery. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-delivered, low-complexity attack needing no attacker privileges but requiring victim interaction (UI:R) and a scope change (S:C), consistent with script executing in the victim's browser session rather than on the server. No EPSS score, CISA KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Real-world risk is moderated by two compounding preconditions the description makes explicit: the victim must be an already-authenticated user whose browser loads the admin bundle, and they must follow an attacker-crafted link - anonymous/front-end-only visitors are not exposed. This places it closer to a targeted social-engineering vector against logged-in administrators than a mass-exploitable flaw; it is a worthwhile patch priority for teams running the admin UI but not an emergency absent exploitation signals. Note: no SSVC decision data was supplied, so exploitation/automatable/technical-impact cannot be scored from the input.

An attacker sends a logged-in ApostropheCMS editor or admin a link containing a crafted query string using __proto__/constructor/prototype keys. When the victim opens it while the admin bundle is loaded, parseQuery mutates the browser prototype chain, a polluted property reaches an unsafe DOM sink, and attacker-controlled script runs in the victim's authenticated session (e.g., to perform actions or steal session context). No public exploit was identified at time of analysis, and the attack requires the victim to click the link (UI:R) despite low attack complexity.