ApostropheCMS EUVD-2026-105184

Requires an authenticated ApostropheCMS user who has been granted permission to import an enabled content type but who has NOT been granted that content type's stronger publication/publish role, with the @apostrophecms/import-export module installed and the content type configured as import-enabled. Exploitation is limited by the need for valid editor-level credentials with import rights (PR:L) and is only meaningful in deployments that intentionally separate import permission from publish permission; installations where importers already hold publish rights gain no additional privilege from this flaw.

This is a moderate-severity authorization flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) rather than a top-priority emergency. The CVSS vector indicates a network-reachable, low-complexity attack but explicitly requires low privileges (PR:L) - consistent with the description, which states the actor is an authenticated editor who holds import rights but lacks the stronger publication role. Impact is integrity-only (I:H; C:N/A:N), matching CWE-862 (Missing Authorization). No EPSS score was provided, there is no CISA KEV listing, and no public proof-of-concept was supplied, so there is no public exploit identified at time of analysis. The absence of exploitation signals combined with the requirement for a valid, semi-privileged insider account means real-world risk is primarily an insider/privilege-boundary concern (an editor escalating their effective publishing authority) rather than mass remote exploitation. Priority should be routine-to-elevated patching for deployments that delegate import rights to users who are intentionally denied publish rights.

An authenticated editor is granted permission to import an enabled content type but is deliberately not given that type's publication role. By running an import, the editor triggers import write helpers that create, replace, or remove published document variants, effectively bypassing the publish permission and lifecycle checks they should be subject to. No public exploit code is known, and the attack requires valid editor credentials with import access (PR:L, no user interaction).