The vulnerability lies in the import‑export module of ApostropheCMS. When a duplicate import is continued, the system accepts a client‑supplied replacement choice without confirming that the requesting user is authorized to modify the target document. A contributor with draft‑editing permissions can therefore select a published document for replacement, effectively overwriting published content and bypassing the intended publication boundary. This results in an integrity compromise by allowing arbitrary content modification or deletion.

Affected installations are those running the import‑export module version earlier than 3.7.1 under the @apostrophecms:mport-export vendor. Because the module is bundled with the core apostrophecms:apostrophe product, any ApostropheCMS deployment that has not upgraded to the fixed module is vulnerable whenever the import‑export feature is enabled.

The CVSS score of 6.5 indicates medium severity. The EPSS score is not available, so the exact exploitation likelihood cannot be quantified; however, the need for authenticated draft‑editing authority and a crafted import request makes widespread exploitation unlikely. The vulnerability is not listed in the CISA KEV catalog, suggesting limited active exploitation. Nevertheless, an internal attacker with the appropriate role could overwrite legitimate published content, leading to significant integrity damage.