CVE-2026-113648: ApostropheCMS: Missing Authentication in `cleanExport` Route
The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method.
References
- github.com/advisories/GHSA-rw26-wwfc-9wvm
- github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
- github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
- github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1
- github.com/apostrophecms/apostrophe/security/advisories/GHSA-rw26-wwfc-9wvm
- nvd.nist.gov/vuln/detail/CVE-2026-113648
Code Behaviors & Features
Detect and mitigate CVE-2026-113648 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →