CVE-2026-33877

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33877", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-24T15:10:05.680Z", "datePublished": "2026-04-15T19:11:06.796Z", "dateUpdated": "2026-04-15T19:30:53.040Z"}, "containers": {"cna": {"title": "ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-208", "lang": "en", "description": "CWE-208: Observable Timing Discrepancy", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mj7r-x3h3-7rmr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mj7r-x3h3-7rmr"}, {"name": "https://github.com/apostrophecms/apostrophe/commit/e266cffd8c0d331a9b05c92bf11616556efcdc77", "tags": ["x_refsource_MISC"], "url": "https://github.com/apostrophecms/apostrophe/commit/e266cffd8c0d331a9b05c92bf11616556efcdc77"}], "affected": [{"vendor": "apostrophecms", "product": "apostrophe", "versions": [{"version": "< 4.29.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-15T19:11:06.796Z"}, "descriptions": [{"lang": "en", "value": "ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-channel vulnerability in the password reset endpoint (/api/v1/@apostrophecms/login/reset-request) that allows unauthenticated username and email enumeration. When a user is not found, the handler returns after a fixed 2-second artificial delay, but when a valid user is found, it performs a MongoDB update and SMTP email send with no equivalent delay normalization, producing measurably different response times. The endpoint also accepts both username and email via an $or query, and has no rate limiting as the existing checkLoginAttempts throttle only applies to the login flow. This enables automated enumeration of valid accounts for use in credential stuffing or targeted phishing. Only instances that have explicitly enabled the passwordReset option are affected, as it defaults to false. This issue has been fixed in version 4.29.0."}], "source": {"advisory": "GHSA-mj7r-x3h3-7rmr", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mj7r-x3h3-7rmr", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T19:30:48.946765Z", "id": "CVE-2026-33877", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T19:30:53.040Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33877", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T19:30:48.946765Z"}}}], "references": [{"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mj7r-x3h3-7rmr", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T19:30:33.569Z"}}], "cna": {"title": "ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint", "source": {"advisory": "GHSA-mj7r-x3h3-7rmr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "apostrophecms", "product": "apostrophe", "versions": [{"status": "affected", "version": "< 4.29.0"}]}], "references": [{"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mj7r-x3h3-7rmr", "name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mj7r-x3h3-7rmr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/apostrophecms/apostrophe/commit/e266cffd8c0d331a9b05c92bf11616556efcdc77", "name": "https://github.com/apostrophecms/apostrophe/commit/e266cffd8c0d331a9b05c92bf11616556efcdc77", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-channel vulnerability in the password reset endpoint (/api/v1/@apostrophecms/login/reset-request) that allows unauthenticated username and email enumeration. When a user is not found, the handler returns after a fixed 2-second artificial delay, but when a valid user is found, it performs a MongoDB update and SMTP email send with no equivalent delay normalization, producing measurably different response times. The endpoint also accepts both username and email via an $or query, and has no rate limiting as the existing checkLoginAttempts throttle only applies to the login flow. This enables automated enumeration of valid accounts for use in credential stuffing or targeted phishing. Only instances that have explicitly enabled the passwordReset option are affected, as it defaults to false. This issue has been fixed in version 4.29.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "CWE-208: Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-15T19:11:06.796Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33877", "state": "PUBLISHED", "dateUpdated": "2026-04-15T19:30:53.040Z", "dateReserved": "2026-03-24T15:10:05.680Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-15T19:11:06.796Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "apostrophe", "vendor": "apostrophecms", "versions": [{"status": "affected", "version": "< 4.29.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*", "matchCriteriaId": "2CFAFBDF-2EB1-404B-B370-8C510FC289AE", "versionEndExcluding": "4.29.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-channel vulnerability in the password reset endpoint (/api/v1/@apostrophecms/login/reset-request) that allows unauthenticated username and email enumeration. When a user is not found, the handler returns after a fixed 2-second artificial delay, but when a valid user is found, it performs a MongoDB update and SMTP email send with no equivalent delay normalization, producing measurably different response times. The endpoint also accepts both username and email via an $or query, and has no rate limiting as the existing checkLoginAttempts throttle only applies to the login flow. This enables automated enumeration of valid accounts for use in credential stuffing or targeted phishing. Only instances that have explicitly enabled the passwordReset option are affected, as it defaults to false. This issue has been fixed in version 4.29.0."}, {"lang": "es", "value": "ApostropheCMS es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto Node.js. Las versiones 4.28.0 y anteriores contienen una vulnerabilidad de canal lateral de tiempo en el endpoint de restablecimiento de contrase\u00f1a (/API/v1/@apostrophecms/login/reset-request) que permite la enumeraci\u00f3n no autenticada de nombres de usuario y correos electr\u00f3nicos. Cuando no se encuentra un usuario, el gestor devuelve despu\u00e9s de un retraso artificial fijo de 2 segundos, pero cuando se encuentra un usuario v\u00e1lido, realiza una actualizaci\u00f3n de MongoDB y un env\u00edo de correo electr\u00f3nico SMTP sin una normalizaci\u00f3n de retraso equivalente, produciendo tiempos de respuesta mediblemente diferentes. El endpoint tambi\u00e9n acepta tanto el nombre de usuario como el correo electr\u00f3nico a trav\u00e9s de una consulta $or, y no tiene rate limiting ya que la limitaci\u00f3n checkLoginAttempts existente solo se aplica al flujo de inicio de sesi\u00f3n. Esto permite la enumeraci\u00f3n automatizada de cuentas v\u00e1lidas para su uso en credential stuffing o phishing dirigido. Solo las instancias que han habilitado expl\u00edcitamente la opci\u00f3n passwordReset se ven afectadas, ya que por defecto es false. Este problema ha sido solucionado en la versi\u00f3n 4.29.0."}], "id": "CVE-2026-33877", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33877", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T19:30:48.946765Z", "version": "2.0.3"}}]}, "published": "2026-04-15T20:16:35.517", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/apostrophecms/apostrophe/commit/e266cffd8c0d331a9b05c92bf11616556efcdc77"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mj7r-x3h3-7rmr"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mj7r-x3h3-7rmr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-208"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.29.0)"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "apostrophe", "source": "cna", "vendor": "apostrophecms"}, "product": "apostrophecms", "vendor": "apostrophecms"}], "analysis": {"en": {"generated_at": "2026-04-15T21:55:37.552718+00:00", "value": {"mitigation_remediation": ["Upgrade the application to version 4.29.0 or later, which removes the timing discrepancy.", "If an upgrade is not possible, disable the passwordReset capability by setting the option to false.", "Implement application\u2011level rate limiting or enforce a uniform response delay for the reset endpoint to obfuscate timing differences."], "summary": {"action": "Apply Patch", "impact": "User Enumeration via Timing Side Channel"}, "threat_synthesis": {"affected_systems": "The issue affects ApostropheCMS versions 4.28.0 and earlier. It only poses a risk when the passwordReset feature is enabled, which defaults to false. The affected product is the Node.js content\u2011management system developed by apostrophecms under the name apostrophe.", "description_and_impact": "The flaw is a timing side\u2011channel in the password reset endpoint that leaks whether a username or email exists. An unauthenticated caller receives a fixed two\u2011second delay when a target is absent, but a noticeably faster response when the target is present because a database update and email are performed. This difference allows an attacker to enumerate valid accounts, which aids credential\u2011stuffing or targeted phishing. The weakness is a classic timing side\u2011channel vulnerability (CWE\u2011208).", "risk_and_exploitability": "The CVSS base score is 3.7, indicating a low\u2011severity vulnerability. EPSS is not available, making it unclear how frequently it has been exploited, and the item is not listed in CISA's KEV catalog. An attacker would issue unauthenticated HTTP requests to /api/v1/@apostrophecms/login/reset-request, observe response times, and map valid usernames or email addresses. The lack of rate limiting allows automated scripts to conduct enumeration quickly. Without additional controls, enumerated accounts can be used in credential stuffing or social\u2011engineering attacks."}}}}, "created": "2026-04-15T22:00:06.619137+00:00", "updated": "2026-04-16T09:00:05.127573+00:00", "vendors": ["apostrophecms", "apostrophecms$PRODUCT$apostrophecms"]}