CVE-2026-32730
ApostropheCMS is an open-source content management framework.
Published Mar 18, 2026 · updated Jun 17, 2026 · apostrophecms apostrophecms
ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using or any custom login requirement. Version 4.28.0 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 18, 2026 · NIST NVD
Detected
ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for an
Jun 17, 2026 · NIST NVD
Updated
ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for an
Affected
- cpe apostrophecms/apostrophecmsversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-32730
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-32730
ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was
nvd.nist.gov