ApostropheCMS exposes PATCH and DELETE endpoints on notifications without proper checks that the request originates from an authenticated user who owns the notification. An attacker who learns a valid notification ID can alter or permanently remove another user's notification. This flaw represents an authorization bypass (CWE-639 and CWE-862) that compromises the integrity of stored data and may expose sensitive content.

The vulnerability affects installations of ApostropheCMS earlier than version 4.33.0. The impacted component is the notification module of the open‑source Node.js CMS. All releases prior to 4.33.0 are susceptible; users of those versions should note that their notification data can be tampered with.

The CVSS score is 3.7, indicating low severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack can be carried out through the web API, requiring only the knowledge of a valid notification ID but no authentication. Because the endpoints are publicly reachable and no ownership checks exist, an attacker can modify or delete notifications without raising alarms, though the impact on confidentiality is limited to the content of the notification.