CVE-2026-113652CWE-200CWE-522information-disclosure

CVE-2026-113652

Medium · published October 20, 2026

CVSS v3.1
5.6
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00262 · 17.1th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-522 · Insufficiently Protected Credentials
Published
2026-10-20T21:17Z
References (4)
https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce · [email protected]https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350 · [email protected]https://github.com/apostrophecms/apostrophe/releases/tag/[email protected] · [email protected]https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hhph-8536-gfq5 · [email protected]
EPSS history
Timeline
  • 22 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 20 OCT 16:26Z
    ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
    cvelistv5
  • 20 OCT 16:26Z
    ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
    cvelistv5