CVE-2026-113648 ApostropheCMS: Missing Authentication in `cleanExport` Route
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-113648?
CVE-2026-113648 is a low-severity vulnerability in @apostrophecms apostrophe, published on 20 Oct 2026.
Official description
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.
Which versions are affected by CVE-2026-113648?
2 open source packages ship an affected version, including @apostrophecms/import-export.
| Package | Affected | Fixed in |
|---|---|---|
@apostrophecms/import-export npm | All versions | 3.7.1 |
@apostrophecms/import-export npm | All versions | 3.7.1 |
How do I fix CVE-2026-113648?
Upgrade @apostrophecms/import-export to 3.7.1 or later.
Is CVE-2026-113648 being exploited?
There is no known exploitation of CVE-2026-113648 in the wild and no public exploit code.
Sources
Also known as GHSA-rw26-wwfc-9wvm.