{"id":"ghsa-ghsa-653j-g8j7-gh54","seq":2415,"kind":"advisory","title":"ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing","url":"https://github.com/advisories/GHSA-653j-g8j7-gh54","permalink":"https://vulnpulse.app/items/ghsa-ghsa-653j-g8j7-gh54","summary":"影響: npm:apostrophe < 4.33.0 → 4.33.0\nSummary The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. Exact source path packages/apostrophe/modules/@apostrophecms/settings/index.js:621-664 The password-change route is: PATCH /api/v1/@apostrophecms/settings/password The ro…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-113710"],"tags":["GHSA-653j-g8j7-gh54","apostrophe"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T18:17:50.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}