ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)

ApostropheCMS: Import API bypasses publication roles for protected content

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

ApostropheCMS: Import archives can exhaust server storage and deny service

ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)

ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context

ApostropheCMS: Cross-domain session token in URL confers session takeover

ApostropheCMS: CAPTCHA response token not URL-encoded

ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltip

Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions

ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API

ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user