CVE-2026-45013: Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation

Synopsis

This is a weak password reset mechanism (Host header injection) in ApostropheCMS, an open-source Node.js content management system, affecting all versions up to and including 4.29.0. The vulnerability is reachable over the network with no authentication required, but it does require the victim to click a malicious password reset link delivered to their inbox. Successful exploitation gives the attacker the victim's valid reset token, enabling full account takeover. HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available the moment a fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the application's password reset endpoint over the network to send a crafted request with a malicious Host header.

• AuthenticationNot required

  No account or credentials are needed; the attacker only requires knowledge of a target user's email address.

• Victim interactionRequired

  The victim must click the attacker-crafted password reset link delivered to their email inbox for the reset token to be exfiltrated.

• Attack complexityDetail

  The exploit is reliable and condition-free once a target email is known; no race conditions or special environmental factors are required.

Blast Radius

• Attacker receives the victim's valid password reset token, granting the ability to set a new password and take over the account entirely.
• Attacker gains full read and write access to all content and data the compromised account can reach within the CMS.
• If the compromised account holds editor or admin privileges, the attacker can modify, publish, or delete site content and alter CMS configuration.