CVE-2026-32730 - Vulnerability Analysis

Overview

ApostropheCMS < 4.28.0 contains a broken authentication caused by incorrect MongoDB query in bearer token middleware, letting attackers bypass multi-factor authentication using incomplete login tokens, exploit requires valid password verification.

Severity & Score

Impact

Attackers can bypass multi-factor authentication, gaining full access with only password verification.

Mitigation

Upgrade to version 4.28.0 or later.

References

• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-v9xm-ffx2-7h35

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 18, 2026

🟠 CVE-2026-32730 - High (8.1) ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32730/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner