ApostropheCMS CVE-2026-113662

Exploitation requires an authenticated ApostropheCMS account that (1) has been granted import access to a specific document type via the import-export module, and (2) already holds generic edit permission on candidate documents of that type. The attacker must supply an object or MongoDB operator in place of a scalar update-key value in the import payload. Key LIMITING factors: the findForEditing permission filter constrains matches to documents the attacker can already edit, so no protected/arbitrary content outside their edit scope can be overwritten; the specific document matched is unidentified/not attacker-controlled, limiting precision; and both import access and edit permission are prerequisites, excluding anonymous or low-privilege users. Only affects import-export module versions prior to 3.7.0.

This is a genuine but moderate-priority access-control flaw (CWE-284), not a critical issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) correctly reflects that exploitation is network-reachable but requires an authenticated account (PR:L) that already holds import access AND generic edit permission on the target document type. No EPSS score, KEV listing, or public POC is present in the input, so there is no signal of active or imminent widespread exploitation - exploitation status is 'no public exploit identified at time of analysis.' The 'Authentication Bypass' tag overstates the issue: the description explicitly states the normal findForEditing permission filter still constrains which documents can be matched, so this is NOT a permission-free overwrite of protected content - it is a privileged user being able to redirect an import update toward an unintended (but already editable-to-them) document via a NoSQL operator/object injected as an update-key value. The C:N rating is consistent with the description (no data disclosure). The A:L rating is debatable - the mechanism is content modification/overwrite, which is primarily an integrity concern; verify whether availability impact truly applies. Overall: a legitimate authorization-logic bug worth patching, but the authenticated precondition and permission filter sharply limit real-world blast radius - this is a routine-priority fix, not an emergency.

An authenticated ApostropheCMS user who has been granted import access to a document type crafts an import payload supplying a MongoDB object or operator (rather than a scalar value) as the update-key. The malformed query matches an existing document the attacker holds generic edit rights to but did not intend/was not supposed to specifically target, causing that document's content to be overwritten by the import data. No public exploit code is identified in the provided data; the attack requires valid credentials and pre-existing import+edit permissions.