ApostropheCMS's import-export module permits a NoSQL injection when an authenticated user supplies an object or operator as the update-key. This injection can match an unidentified document that the user can edit, enabling the attacker to alter that content. The issue does not bypass normal permission checks, but any document within the user's edit scope can be overwritten, potentially compromising data integrity.

Version <3.7.0 of the @apostrophecms/import-export module, bundled with ApostropheCMS core, is vulnerable. The vulnerability affects any environment using imports where users have import access to a target type. Once patched to 3.7.0 or later, the issue is resolved.

The CVSS score of 5.4 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting lower current exploitation likelihood. Exploitation requires authenticated access with import permissions, so an attacker must first obtain or hijack such credentials. The attack vector is constrained to the import functionality, limiting impact to documents within the attacker's permission scope.