CVE-2026-53609: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

Synopsis

Server-side prototype pollution in ApostropheCMS (versions up to and including 4.30.0) allows an authenticated editor to write arbitrary values to Object.prototype via the apos.util.set() function by passing unsanitized __proto__ keys through the $pullAll patch operator. The attack is reachable over the network with a low-privilege account and no victim interaction required. Successful exploitation activates a confirmed gadget in publicApiCheck() that disables authorization checks on all piece-type REST API endpoints for every subsequent request for the lifetime of the Node.js process, effectively granting unauthenticated access to protected data and operations across the entire application. HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment upstream publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable apos.util.set() code path is exposed over the network via ApostropheCMS REST API endpoints, so the attacker must be able to reach the service over the network.

• AuthenticationRequired

  A low-privilege editor account is sufficient; the attacker does not need administrative credentials to submit the malicious patch operator payload.

• Victim interactionNot required

  No victim action is needed; the attacker submits the crafted request directly and the prototype pollution takes effect immediately in the Node.js process.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or other environmental preconditions beyond network access and a valid low-privilege account.

Blast Radius

• Reads any data returned by piece-type REST API endpoints that were previously protected by authorization checks, including content, user records, and configuration exposed through those endpoints.
• Bypasses authorization for all subsequent unauthenticated requests to piece-type REST API endpoints for the lifetime of the running Node.js process, meaning the window of exposure persists until the process is restarted.
• Allows modification of piece-type resources via unauthenticated REST API calls if write endpoints are covered by the bypassed authorization checks.
• Degrades integrity of access controls process-wide, meaning other authenticated workflows that rely on the same authorization mechanism may also be affected.