---
id: CVE-2026-113648
title: 'ApostropheCMS: Missing Authentication in `cleanExport` Route'
summary: >-
  ApostropheCMS is an open-source Node.js content management system. Prior to
  3.7.1 of the import-export module, the API endpoint POST
  /api/v1/@apostrophecms/import-export/clean-export in
  @apostrophecms/import-export lacks authentication a…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-306
  - CWE-862
vendor: apostrophecms
product: apostrophe
affected:
  - apostrophe < 4.34.0
  - import-export < 3.7.1
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T16:18:53.068Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113648'
references:
  - url: >-
      https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rw26-wwfc-9wvm
    label: >-
      https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rw26-wwfc-9wvm
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
    label: >-
      https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
    label: >-
      https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
  - url: >-
      https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1
    label: >-
      https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1
tags:
  - cve.org
ingestedAt: '2026-10-20T17:12:53.604Z'
---

## Overview

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.

## Affected

- `apostrophe < 4.34.0`
- `import-export < 3.7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.