Prior to version 3.7.1 of the import‑export module and 4.34.0 of core ApostropheCMS, an editor who can perform imports but does not possess the stronger publication role can use the import API to create, replace, or delete published variants of content without passing the normal publish permission checks or lifecycle validations. This flaw permits the editor to override protective controls and add or modify live content that should only be changed by authorized publishers, thereby compromising the integrity of the site’s published output. The weakness is classified as an unauthorized access to privileged information issue.

The vulnerability exists in both the ApostropheCMS core (any release earlier than 4.34.0) and the import‑export plugin (any release earlier than 3.7.1). Site administrators should verify the exact version of each component to determine whether a fix is required.

The CVSS score of 6.5 indicates moderate severity, and the vulnerability is currently not listed in the CISA KEV catalog. No EPSS value is available. An attacker must be authenticated with editor‑level permissions and access the import‑export API, which is ordinarily exposed via the web interface, so the exploit can be performed remotely by any authenticated user with import capability. Once the import is executed, the attacker's unauthorized actions immediately affect live content, giving them the ability to publish content without the required lifecycle checks. Because the attack requires only legitimate credentials and basic API usage, the likelihood of exploitation is significant for organizations that enable many users to perform imports.