CVE-2026-113666
Description
A flaw was found in ApostropheCMS. An authenticated remote user with draft viewing permissions can supply a specially crafted query projection path when database adapters such as SQLite or PostgreSQL are configured. This action causes the application to delete shared internal runtime properties, resulting in persistent process instability and a Denial of Service (DoS).
Statement
Red Hat has classified this flaw as having an Important severity because an authenticated user can trigger a persistent, process-wide denial of service by corrupting shared prototype methods in the Node.js execution environment. Although exploitation requires non-default database adapter configurations such as SQLite or PostgreSQL, any account with basic draft-viewing privileges can induce application failure across all tenants until the service is restarted. Red Hat products do not distribute ApostropheCMS, and standard installations utilizing the default MongoDB backend are not susceptible to this vulnerability.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
An attacker could modify sensitive data or program variables.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Other,Integrity
Technical Impact: Varies by Context; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
