CVE-2026-45013— Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation

Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTTP `Host` header when `apos.baseUrl` is not explicitly configured. An unauthenticated attacker who knows a victim's email address can send a crafted reset request that causes the application to email the victim a reset link pointing to the attacker's domain. When the victim clicks the link, the valid reset token is delivered to the attacker, enabling full account takeover. As of time of publication, no known patched versions are available.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

输入验证不恰当

ApostropheCMS 输入验证错误漏洞

apostrophecms是Apostrophecms公司开源的一个内容管理系统。 ApostropheCMS 4.29.0及之前版本存在安全漏洞，该漏洞源于密码重置流程使用`req.hostname`构造重置URL，当`apos.baseUrl`未明确配置时，该值直接来源于攻击者控制的HTTP `Host`头，可能导致未经验证的攻击者利用特制重置请求将重置链接指向攻击者域名，从而获取有效重置令牌并实现账户接管。

N/A

N/A