CVE-2026-45013

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTTP `Host` header when `apos.baseUrl` is not explicitly configured. An unauthenticated attacker who knows a victim's email address can send a crafted reset request that causes the application to email the victim a reset link pointing to the attacker's domain. When the victim clicks the link, the valid reset token is delivered to the attacker, enabling full account takeover. As of time of publication, no known patched versions are available.

• CWE-20
• CWE-640

• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gf43-24g3-5hw2
• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gf43-24g3-5hw2

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45007phpMyFAQ before 4.1.2 contains missing permission checks in …5.3
• CVE-2026-45008phpMyFAQ before 4.1.2 contains a path traversal vulnerabilit…7
• CVE-2026-45009phpMyFAQ before 4.1.2 contains an insufficient authorization…5.3
• CVE-2026-45010phpMyFAQ before 4.1.2 contains an improper restriction of ex…9.3
• CVE-2026-45011ApostropheCMS is an open-source Node.js content management s…7.3
• CVE-2026-45012ApostropheCMS is an open-source Node.js content management s…7.6
• CVE-2026-45014ApostropheCMS is an open-source Node.js content management s…5.3
• CVE-2026-45017Python Liquid is a Python engine for the Liquid template lan…7.5
• CVE-2026-4502IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allo…6.5
• CVE-2026-45021Kuma is a modern Envoy-based service mesh that can run on ev…5.1
• CVE-2026-45022go-git is an extensible git implementation library written i…7.5
• CVE-2026-45023AutoGPT is a workflow automation platform for creating, depl…5.4