Description
ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.
Published: 2026-08-17
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An authenticated editor can send a PATCH request to /api/v1/article/:id and abuse a second‑order prototype pollution flaw that overwrites the shared Object.prototype.toString.call property. This change propagates process‑wide, causing the Node.js runtime to fail on every call that uses toString, leading to a persistent denial of service until a restart. The weakness is identified as CWE‑1321, a second‑order prototype pollution vulnerability.

Affected Systems

The problem exists in ApostropheCMS versions 4.32.0 and earlier. Users running those releases who have editor or higher permissions are able to trigger the flaw.

Risk and Exploitability

The CVSS score of 7.1 reflects a moderate severity; the exploit requires authenticated access, limiting casual exploitation. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to compromise an editor account or gain authentication through other means to reach the vulnerable endpoint.

Generated by OpenCVE AI on August 17, 2026 at 21:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ApostropheCMS to the latest major release that contains the prototype‑polution fix, for example 4.33.0 or later.
  • If an upgrade is temporarily infeasible, restrict editor roles so that they cannot perform PATCH requests on /api/v1/article/:id, or disable that endpoint entirely.
  • Implement input validation or a sanitization layer that blocks attempts to overwrite Object.prototype properties, ensuring that calls to apos.util.set() and apos.util.get() cannot affect built‑in prototypes.

Generated by OpenCVE AI on August 17, 2026 at 21:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Description ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.
Title ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
Weaknesses CWE-1321
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-17T20:14:15.721Z

Reserved: 2026-08-06T21:24:15.376Z

Link: CVE-2026-71553

cve-icon Vulnrichment

Updated: 2026-08-17T20:14:07.451Z

cve-icon NVD

Status : Received

Published: 2026-08-17T20:16:46.073

Modified: 2026-08-17T20:16:46.073

Link: CVE-2026-71553

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T21:45:03Z

Weaknesses
  • CWE-1321

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')