The vulnerability arises from an incorrect MongoDB query in the bearer token authentication middleware. Tokens that have a valid password but do not satisfy the Time‑Based One‑Time Password (TOTP) or other multi‑factor authentication (MFA) requirement are mistakenly accepted as fully authenticated. Consequently an attacker who obtains or crafts such an incomplete token can gain full access to the site with the privileges of the account whose credentials were used, bypassing all MFA enforcement. This enables unauthorized read, write or administrative operations, compromising confidentiality, integrity, and availability of the CMS content and configuration.

The flaw affects ApostropheCMS deployments built with the open‑source framework up to version 4.27.x. Packages using the @apostrophecms/login‑totp module or any custom afterPasswordVerified login requirement are vulnerable. The update delivered in version 4.28.0 corrects the query and restores MFA enforcement.

The CVSS score of 8.1 indicates a high severity vulnerability. The EPSS score is less than 1 %, suggesting that, while highly impactful, the probability of large‑scale exploitation currently appears low, and the issue has not yet entered the CISA Known Exploited Vulnerabilities catalog. An attacker can exploit the flaw remotely by presenting a bearer token that passes password verification but fails MFA checks, and no additional credentials or local access are required. The attack vector is therefore remote. Because the weakness resides in the server‑side authentication logic, a successful exploit immediately grants full administrative access to the application.