CVE-2026-45012Disclosure

LOWCVSS 7.6 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For image-compatible responses, the fetched content can be persisted and re-hosted by Apostrophe, allowing response exfiltration. As of time of publication, no known patched versions are available.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
3 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 3 classified signals
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Full discourse3 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters137d
Disclosure
#CVE-2026-45012 - SSRF in Apostrophecms 4.29.0 and below. Authenticated users can exploit rich-text widget import to exfiltrate data. #CVSS 7.6. No patch available. Mitigate by restricting widget access. #ApostropheCMS #infosec #cybersecurity #developers More: https://www.valtersit.com/cve/CVE-2026-45012
Post summary
The tweet discloses CVE-2026-45012 as an SSRF flaw in Apostrophecms 4.29.0 and earlier, notes no patch yet, and advises limiting widget access; it contains no evidence of active exploitation or PoC.
0000070
929 followersView on X
Infoflowcloud@infoflowcloud137d
Disclosure
🚨*CVE* CVE-2026-45012 ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in … https://www.cve.org/CVERecord?id=CVE-2026-45012 ----- Traducción: CVE-2026-45012 Apo… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-45012 for ApostropheCMS, noting an authenticated SSRF vulnerability in versions up to 4.29.0, and links to the official CVE entry, but provides no exploit, patch, or active‑use details.
0000036
79 followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-45012 ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in … https://www.cve.org/CVERecord?id=CVE-2026-45012
Post summary
An announcement of CVE‑2026‑45012 reveals an authenticated SSRF flaw in ApostropheCMS versions up to 4.29.0; the post provides basic vulnerability details but no PoC, exploit, or remediation information.
00000212
57.6K followersView on X

Explore more

Back to dashboard