Mport Export
Monthly
An authorization bypass in the @apostrophecms/import-export module of ApostropheCMS (versions prior to 3.7.1) lets a low-privilege contributor with draft editing rights cross the publication boundary during a duplicate-import continuation. Because the module accepts a client-supplied replacement choice without binding it to a server-side analysis owned by that user or re-authorizing the canonical target document, the contributor can select a published document for replacement on an import-enabled localized type and modify content they should not be able to touch. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with integrity-only impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor's current assessment derives from remediation review rather than a repeated end-to-end reproduction.
An authorization bypass in the @apostrophecms/import-export module of ApostropheCMS (versions prior to 3.7.1) lets a low-privilege contributor with draft editing rights cross the publication boundary during a duplicate-import continuation. Because the module accepts a client-supplied replacement choice without binding it to a server-side analysis owned by that user or re-authorizing the canonical target document, the contributor can select a published document for replacement on an import-enabled localized type and modify content they should not be able to touch. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with integrity-only impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor's current assessment derives from remediation review rather than a repeated end-to-end reproduction.