## ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-113710
- 公開日時: 2026-10-20T18:17:50.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-653j-g8j7-gh54)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-653j-g8j7-gh54

影響: npm:apostrophe < 4.33.0 → 4.33.0
Summary The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. Exact source path packages/apostrophe/modules/@apostrophecms/settings/index.js:621-664 The password-change route is: PATCH /api/v1/@apostrophecms/settings/password The ro…