CVE-2026-112956

MediumCVSS 6.5/10Last modified Oct 20, 2026

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather than a repeated end-to-end reproduction. This issue is fixed in version 3.7.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Oct 20, 2026
Last modified
Oct 20, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1129574.3ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRoCVE-2026-1129585.4ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carryCVE-2026-112967.5Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendeCVE-2026-1129655.5Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.CVE-2026-1129667.5Uncontrolled resource consumption in Windows Security Account Manager allows an unauthorized attacker to deny service over a network.CVE-2026-1129679.8Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.CVE-2026-1129687.0Use after free in Windows COM allows an authorized attacker to elevate privileges locally.CVE-2026-1129696.6Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges with a physical attack.CVE-2026-112977.7Insufficient validation of untrusted input in Reader Mode in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to bypCVE-2026-1129707.0Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.CVE-2026-1129717.0Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally.CVE-2026-1129727.5Integer overflow or wraparound in Windows SMB Server allows an authorized attacker to execute code over a network.
CVE-2026-112956: Medium severity, CVSS 6.5 | Vulnix