PT-2026-33119 · Unknown · Apostrophe Cms

Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-33877

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.29.0

Description A timing side-channel issue exists in the password reset endpoint '/api/v1/@apostrophecms/login/reset-request' that allows unauthenticated users to enumerate valid usernames and email addresses. The system uses a fixed 2-second artificial delay when a user is not found, but when a valid user is identified, it performs MongoDB updates and SMTP email operations without equivalent delay normalization. This creates measurably different response times based on whether the account exists. The endpoint accepts both username and email via an $or query and lacks rate limiting, as the checkLoginAttempts throttle only applies to the login flow. This issue only affects instances where the passwordReset option is explicitly enabled, as it is disabled by default.

Recommendations Update to version 4.29.0. As a temporary workaround, disable the passwordReset option in the @apostrophecms/login configuration to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2026-33877

GHSA-MJ7R-X3H3-7RMR

Affected Products

Apostrophe Cms

References · 6

• 🔥 https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mj7r-x3h3-7rmr · Exploit
• https://github.com/apostrophecms/apostrophe/commit/e266cffd8c0d331a9b05c92bf11616556efcdc77 · Patch
• https://osv.dev/vulnerability/GHSA-mj7r-x3h3-7rmr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33877 · Security Note
• https://github.com/apostrophecms/apostrophe · Note
• https://twitter.com/CVEnew/status/2044701626087411728 · Twitter Post