Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement. Version 4.28.0 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-18 | 1 | Disclosure1 |
| 2026-03-19 | 2 | Disclosure2 |
CVE-2026-32730 ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js`… https://www.cve.org/CVERecord?id=CVE-2026-32730
Post summary
The passage announces that CVE‑2026‑32730 affects the bearer token authentication middleware in ApostropheCMS before version 4.28.0, and that the issue is addressed in the 4.28.0 release.
CVE-2026-32730 Authentication Bypass in ApostropheCMS Bearer Token Middleware Be... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32730 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
An alert posted to Twitter linked to a Vulmon page for CVE‑2026‑32730, highlighting an authentication bypass flaw in ApostropheCMS’s bearer‑token middleware, but no PoC, exploit code, or patch information was included.
🟠 CVE-2026-32730 - High ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains... https://www.thehackerwire.com/vulnerability/CVE-2026-32730/ https://t.co/lgYejRADsY
Post summary
The text discloses a high‑severity vulnerability (CVE‑2026‑32730) in ApostropheCMS’s bearer‑token authentication middleware, but offers no evidence of exploitation, PoC, or remediation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apostrophecms | apostrophecms | - | - | - |