CVE-2026-53609 Details
Description
ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator. A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process. As of time of publication, no known patched versions are available.
A vulnerability in ApostropheCMS versions through 4.30.0 allows for server-side prototype pollution via the apos.util.set() function. This function improperly sanitizes dot-notation paths, enabling an authenticated editor to manipulate Object.prototype by using the $pullAll patch operator. The exploitation of this vulnerability creates a confirmed authorization bypass on all piece-type REST API endpoints, affecting every subsequent unauthenticated request for the duration of the Node.js process.
Developers are advised to reject prototype-related path segments before they are traversed by the apos.util.set() function. This validation should be applied both within the set() function and before user-controlled keys are passed to it from the implementPatchOperators() function.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-6h5j-32cf-4253 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-6h5j-32cf-4253 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ApostropheCMS | <= 4.30.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |