ApostropheCMS allows a logged‑in user who possesses view‑draft access to craft a projection‑exclusion path that travels through a constructor prototype chain and targets a shared prototype member. When this path is processed by the unsetNestedField helper, the shared runtime member is deleted, producing a persistent, process‑wide denial of service. The flaw is a prototype pollution followed by a denial‑of‑service condition, aligning with CWE‑1321 and CWE‑400. A successful exploit disables the application for all users until the process is restarted or the shared member is restored, leading to loss of availability and potential integrity impact if other functions relied on that member.

The vulnerability exists in versions of @apostrophecms/db-connect older than 1.1.0 and apostrophecms:apostrophe older than 4.33.0. It applies only when a SQLite, PostgreSQL, or multipostgres adapter is in use and a document matching the projection exists; the default MongoDB adapter is not affected. All editing roles have the necessary view‑draft access privilege, and guestApiAccess would widen the scope to any logged‑in account.

The CVSS base score is 7.1, indicating a high severity. EPSS is not available, and the issue is not listed in CISA’s KEV catalog, suggesting no known public exploitation yet. The attack requires authenticated access, but the ability to exploit is trivial for any user with view‑draft rights or any logged‑in account under guestApiAccess. Once triggered, the denial of service is immediate and process‑wide, and it persists across requests until the process restarts. The lack of an existing public exploit does not reduce the urgency for applying the official fix.