cvesecurityvulnerability
CVE-2026-53609: ApostropheCMS Prototype Pollution Leads to Authorization Bypass (CVSS 9.1)
ApostropheCMS's apos.util.set() allows authenticated editors to pollute Object.prototype via patch operators, bypassing authorization on all REST API endpoints for subsequent unauthenticated requests. CVSS 9.1. Fixed in version 4.31.0.
