CVE-2021-25979 Apostrophe - Insufficient Session Expiration

Critical 9.8 Published 8 Nov 2021 Updated 30 Apr 2025

Attackers can maintain access via compromised devices because disabling accounts or changing passwords does not invalidate existing sessions in Apostrophe CMS.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-25979?

CVE-2021-25979 is a critical vulnerability in Apostrophe , published on 8 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.

Weakness: CWE-613

Which versions are affected by CVE-2021-25979?

2 open source packages ship an affected version, including apostrophe. It affects 1 product.

Package	Affected	Fixed in
`apostrophe` npm	From `2.63.0`	`3.4.0`
`apostrophe` npm	From `2.63.0`	`3.4.0`

Products include Apostrophecms Apostrophecms.

How do I fix CVE-2021-25979?

Upgrade apostrophe to 3.4.0 or later.

Is CVE-2021-25979 being exploited?

There is no known exploitation of CVE-2021-25979 in the wild and no public exploit code.

Sources

Also known as GHSA-9j9m-8wjc-ff96.