ApostropheCMS versions before 4.33.0 allow an authenticated user to change a password by submitting the current password. The endpoint does not enforce the login module’s throttling, lockout, or delay logic, so repeated guesses can be sent without restriction. This flaw, classified as CWE‑307, enables unlimited current‑password guessing within an authenticated session. Although no elevation of privilege occurs, an attacker could compromise any user account by guessing the correct current password and changing it to a known value, thereby taking control of the account.

All releases of ApostropheCMS before 4.33.0. The issue is fixed in version 4.33.0, which adds proper throttling and lockout mechanisms to the password‑change endpoint.

The CVSS score of 5.9 indicates a medium risk and the EPSS score is not available, making it difficult to assess real‑world exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Attackers need a valid session, which could arise from social engineering or session hijacking, and then can send arbitrary password‑change requests until the correct current password is discovered. Given the lack of lockout, the attack surface is effectively unlimited for that session.