ApostropheCMS CVE-2026-113665

Exploitation targets the PATCH and DELETE REST endpoints of the ApostropheCMS notification module in versions prior to 4.33.0, which operate directly on the MongoDB notifications collection with no authentication or ownership check. The concrete prerequisite is possession of a valid target notification ID; because these IDs are MongoDB ObjectIds that are not easily enumerable or guessable, this is the primary limiting factor and the reason CVSS assigns AC:H. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N). Impact is confined to tampering with or deleting another user's notifications - there is no confidentiality exposure and no service-level denial. Affected deployments are any ApostropheCMS 4.x installation below 4.33.0 running the default notification module.

This is a genuinely low-priority issue whose signals are internally consistent rather than conflicting. The CVSS 3.1 base score of 3.7 (LOW) is driven by AV:N/PR:N/UI:N (network-reachable, unauthenticated, no user interaction) but tempered by AC:H and a limited impact of C:N/I:L/A:N. The AC:H is the key qualifier: exploitation requires the attacker to first obtain a *valid* notification ID (a MongoDB ObjectId that is not readily enumerable), which is why this is not scored as a trivial unauthenticated flaw despite PR:N. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of exploitation probability or active abuse - the absence of these signals is consistent with a low-value, hard-to-weaponize IDOR. The impact ceiling is narrow: an attacker can tamper with or delete another user's UI notifications (I:L), not read confidential data (C:N) or deny service (A:N). CWE-639 (authorization bypass through user-controlled key / IDOR) matches the description precisely. Net: a real but minor authorization defect, correctly rated LOW; patch during normal maintenance, not an emergency. One caveat: the description says notifications can be *permanently* deleted, which one could argue nudges toward a minor availability impact on that data - NVD scored A:N, treating deletion as an integrity effect, which is defensible.

An unauthenticated attacker who learns or otherwise obtains a valid notification ID submits a crafted PATCH or DELETE request directly to ApostropheCMS's notification REST endpoint, which performs the MongoDB operation without checking authentication or ownership. The result is that another user's notification is silently modified or permanently deleted. No public exploit is identified at time of analysis, and the high attack complexity reflects the need to acquire a non-enumerable notification ID first.