CVE-2026-113666

7.1High

Published 20 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on availability
Weakness: CWE-400, CWE-1321

Impact

Authenticated users with view-draft permissions can trigger process crashes and persistent application corruption via prototype pollution. They need a logged-in account (any editor role, or any account if guestApiAccess is enabled) on sites running SQLite, PostgreSQL, or multipostgres adapters.

Root cause

The unsetNestedField helper unsafely traverses the constructor prototype chain during projection exclusion, allowing the deletion of shared runtime prototype members.

Affected systems

ApostropheCMS before 4.33.0 and db-connect before 1.1.0 using SQLite, PostgreSQL, or multipostgres adapters (MongoDB adapter is unaffected).

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Fix & remediation

Upgrade ApostropheCMS to 4.33.0 or higher and db-connect to 1.1.0 or higher. If patching must wait, disable non-default database adapters by falling back to the default MongoDB adapter, or disable guestApiAccess to limit the attack surface.

shell

$ npm install apostrophe@^4.33.0 @apostrophecms/db-connect@^1.1.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-113666