TL;DR: ApostropheCMS version 4.31.0 and earlier contains a server-side prototype pollution in apos.util.set(). An authenticated editor can write to Object.prototype through the $pullAll patch operator, which then bypasses authorization checks on all piece-type REST API endpoints for every subsequent unauthenticated request. Fixed in version 4.31.0.

What to do first

Update ApostropheCMS to version 4.31.0:

npm install [email protected]

After updating, audit your CMS for any pieces that may have been created or modified by unauthorized users during the window of exposure. Check access logs for unusual POST requests to piece-type REST API endpoints.

What happened

apos.util.set() traverses dot-notation paths to set nested properties on objects. It does not sanitize __proto__ in the path. An authenticated editor with access to patch operations can send a $pullAll operator that writes through __proto__, landing a value on Object.prototype.

The authorization bypass is not theoretical. A confirmed gadget in publicApiCheck() reads from the prototype chain. Once Object.prototype is polluted with the right key, every subsequent unauthenticated request to piece-type REST API endpoints passes the authorization check. No token. No session. No credentials. The prototype pollution persists for the lifetime of the Node.js process.

The attack requires an authenticated editor to plant the prototype pollution, but the resulting authorization bypass affects all unauthenticated requests. This split between the planting step and the exploitation step makes the vulnerability harder to detect through access logs alone.

Who is affected

Any ApostropheCMS deployment running version 4.30.x or earlier. Deployments that allow editor accounts with patch permissions are directly exposed. Deployments with restricted editor permissions are still at risk if any editor account is compromised.

Why it matters

CVSS 9.1. CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). Prototype pollution in Node.js is process-wide. Once Object.prototype is modified, every object created afterward inherits the polluted properties. The authorization bypass persists until the process restarts, and it affects every piece-type endpoint in the CMS.

References

• GitHub Security Advisory GHSA-6h5j-32cf-4253
• hol.org CVE entry