CVE-2026-53609

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53609", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-09T19:39:52.404Z", "datePublished": "2026-06-12T20:59:25.486Z", "dateUpdated": "2026-06-15T18:29:55.055Z"}, "containers": {"cna": {"title": "Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-1321", "lang": "en", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-6h5j-32cf-4253", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-6h5j-32cf-4253"}], "affected": [{"vendor": "apostrophecms", "product": "apostrophe", "versions": [{"version": "<= 4.30.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T20:59:25.486Z"}, "descriptions": [{"lang": "en", "value": "ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator. A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process. As of time of publication, no known patched versions are available."}], "source": {"advisory": "GHSA-6h5j-32cf-4253", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-6h5j-32cf-4253", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-15T18:29:44.669655Z", "id": "CVE-2026-53609", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T18:29:55.055Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53609", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T18:29:44.669655Z"}}}], "references": [{"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-6h5j-32cf-4253", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T18:29:37.812Z"}}], "cna": {"title": "Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass", "source": {"advisory": "GHSA-6h5j-32cf-4253", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "apostrophecms", "product": "apostrophe", "versions": [{"status": "affected", "version": "<= 4.30.0"}]}], "references": [{"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-6h5j-32cf-4253", "name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-6h5j-32cf-4253", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator. A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process. As of time of publication, no known patched versions are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T20:59:25.486Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53609", "state": "PUBLISHED", "dateUpdated": "2026-06-15T18:29:55.055Z", "dateReserved": "2026-06-09T19:39:52.404Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-12T20:59:25.486Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "apostrophe", "vendor": "apostrophecms", "versions": [{"status": "affected", "version": "<= 4.30.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator. A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process. As of time of publication, no known patched versions are available."}, {"lang": "es", "value": "ApostropheCMS es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto basado en Node.js. En versiones hasta la 4.30.0 inclusive, \u2019apos.util.set()\u2019 recorre rutas de notaci\u00f3n de puntos sin sanear \u2019__proto__\u2019, permitiendo a un editor autenticado escribir valores arbitrarios en \u2019Object.prototype\u2019 a trav\u00e9s del operador de parche \u2019$pullAll\u2019. Un gadget confirmado en \u2019publicApiCheck()\u2019 hace que esto omita la autorizaci\u00f3n en todos los endpoints de la API REST de tipo \u2019piece\u2019 para cada solicitud no autenticada subsiguiente, durante la vida \u00fatil del proceso de Node.js. En el momento de la publicaci\u00f3n, no hay versiones parcheadas conocidas disponibles."}], "id": "CVE-2026-53609", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.3, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53609", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-15T18:29:44.669655Z", "version": "2.0.3"}}]}, "published": "2026-06-12T22:16:52.803", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-6h5j-32cf-4253"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-6h5j-32cf-4253"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.30.0]"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "apostrophe", "source": "cna", "vendor": "apostrophecms"}, "product": "apostrophecms", "vendor": "apostrophecms"}], "created": "2026-06-12T23:00:08.889030+00:00", "updated": "2026-06-13T12:30:33.116304+00:00", "vendors": ["apostrophecms", "apostrophecms$PRODUCT$apostrophecms"]}