PT-2026-41155 · Apostrophecms+2 · Apostrophe
CVE-2026-45013
·
Published
2026-05-14
·
Updated
2026-06-14
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
ApostropheCMS versions prior to 4.29.0
Description
ApostropheCMS is an open-source Node.js content management system. The password reset flow constructs the reset URL using
req.hostname, which is derived from the attacker-controlled HTTP Host header when apos.baseUrl is not explicitly configured. An unauthenticated attacker who knows a victim's email address can send a crafted request to the '/api/v1/login/reset-request' endpoint. This causes the application to email the victim a reset link pointing to the attacker's domain. When the victim clicks the link, the valid reset token is delivered to the attacker, enabling full account takeover. This issue occurs in the resetRequest route within the modules/@apostrophecms/login/index.js component when passwordReset: true is set and apos.baseUrl is not configured.Recommendations
For versions prior to 4.29.0, explicitly set
apos.baseUrl in the configuration (e.g., within the @apostrophecms/express module options) to ensure the application does not rely on the Host header.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apostrophe