ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 3
- StatusPublished → DeferredNVD modified 2026-10-20 19:53
- StatusReceived → PublishedNVD modified 2026-10-20 17:43
- First seenCVSS 7.1NVD modified 2026-10-20 18:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 6
- https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
- https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
- https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/[email protected]
- https://github.com/apostrophecms/apostrophe/releases/tag/[email protected]
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-j5rq-xfvr-p969
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-j5rq-xfvr-p969