CVE-2026-45013

{
  "id": "CVE-2026-45013",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T21:16:22.850",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTTP `Host` header when `apos.baseUrl` is not explicitly configured. An unauthenticated attacker who knows a victim's email address can send a crafted reset request that causes the application to email the victim a reset link pointing to the attacker's domain. When the victim clicks the link, the valid reset token is delivered to the attacker, enabling full account takeover. As of time of publication, no known patched versions are available."
    },
    {
      "lang": "es",
      "value": "ApostropheCMS es un sistema de gestión de contenido de Node.js de código abierto. Las versiones hasta la 4.29.0 inclusive tienen un flujo de restablecimiento de contraseña que construye la URL de restablecimiento usando ’req.hostname’, que se deriva directamente del encabezado ’Host’ HTTP controlado por el atacante cuando ’apos.baseUrl’ no está configurado explícitamente. Un atacante no autenticado que conoce la dirección de correo electrónico de una víctima puede enviar una solicitud de restablecimiento manipulada que hace que la aplicación envíe a la víctima un enlace de restablecimiento por correo electrónico que apunta al dominio del atacante. Cuando la víctima hace clic en el enlace, el token de restablecimiento válido se entrega al atacante, lo que permite la toma de control total de la cuenta. En el momento de la publicación, no hay versiones parcheadas conocidas disponibles."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "apostrophecms",
          "product": "apostrophe",
          "versions": [
            {
              "version": "<= 4.29.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-13T03:36:29.567752Z",
          "id": "CVE-2026-45013",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-640"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gf43-24g3-5hw2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gf43-24g3-5hw2",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}