---
id: CVE-2026-113649
title: 'ApostropheCMS: Import API bypasses publication roles for protected content'
summary: >-
  ApostropheCMS is an open-source Node.js content management system. Prior to
  3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor
  who can import an enabled content type but lacks its stronger publication role
  can …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: apostrophecms
product: apostrophe
affected:
  - apostrophe < 4.34.0
  - import-export < 3.7.1
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T16:40:16.363Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113649'
references:
  - url: >-
      https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-5m22-7pfq-vp65
    label: >-
      https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-5m22-7pfq-vp65
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
    label: >-
      https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
    label: >-
      https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
  - url: >-
      https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1
    label: >-
      https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1
  - url: 'https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0'
    label: 'https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0'
tags:
  - cve.org
ingestedAt: '2026-10-20T17:12:53.599Z'
---

## Overview

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove published variants without the normal publish permission and lifecycle checks. This issue is fixed in import-export 3.7.1 and ApostropheCMS 4.34.0.

## Affected

- `apostrophe < 4.34.0`
- `import-export < 3.7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.