ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
影響: npm:@apostrophecms/db-connect < 1.1.0 → 1.1.0, npm:apostrophe < 4.33.0 → 4.33.0
@apostrophecms/db-connect ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Its unsetNestedField helper walks an attacker-controlled dotted field path with no segment validation and calls delete on the resolved property. A low-privileged authenticated user (any role holding view-draft, which every editor and contributor has; reduced to any logged-in user when guestApiAccess is enabled) can send a piece-type REST GET request whose project qu…
Read on GitHub Advisory Database
| CVE | CVE-2026-113666 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/22/2026, 01:17 AM |
| Data | Markdown JSON |
On 10/21/2026, 03:03 AM, GitHub Advisory Database published "ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service" (type: Advisory). Severity is "High" (high). Related technologies: JavaScript / Node.js, PostgreSQL, MongoDB, SQLite. CVE: CVE-2026-113666.