The vulnerability is a missing authentication and authorization check on the POST /api/v1/@apostrophecms/import-export/clean-export endpoint of the @apostrophecms/import-export module. This flaw allows any client, including unauthenticated users who hold the standard CSRF cookie from visiting the site, to invoke the underlying self.cleanExport method and trigger an export operation. The weakness is identified by CWE-306 (Missing Authentication) and CWE-862 (Missing Authorization). The impact is the potential for unintended data exports, which could expose system data or configuration information that should be protected.

Affected products include the @apostrophecms/import-export module and the broader apostrophecms:apostrophe content management system, specifically any installation running a version prior to 3.7.1 of the import-export module. The public API route lacks a guard, so any user who can send an HTTP request to the target can exploit the issue.

The CVSS score of 3.1 classifies the vulnerability as low severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely a simple web request; an attacker must simply acquire the CSRF cookie—something that can be obtained by browsing the site—and then send a POST request before the module is patched. Given the low severity rating and absence of known exploits, the overall risk to a typical deployment is moderate, but the potential data exposure warrants corrective action.