## ApostropheCMS: Import API bypasses publication roles for protected content

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-113649
- 公開日時: 2026-10-21T17:03:03.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-5m22-7pfq-vp65)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-5m22-7pfq-vp65

影響: npm:@apostrophecms/import-export < 3.7.1 → 3.7.1, npm:apostrophe < 4.34.0 → 4.34.0
Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026). Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip extractor, import permission gate, and core permission implementation have no differences between that release tag and the reviewed main. This follow-up is a static remediation review. We have not rep…