8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32730

CVE-2026-32730: ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in @apostrophecms/express/index.js (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using @apostrophecms/login-totp or any custom afterPasswordVerified login requirement. Version 4.28.0 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32730

CVE-2026-32730:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
apostrophe	npm	<= 4.27.1	4.28.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the corresponding patch commit reveals a critical multi-factor authentication bypass in ApostropheCMS. The root cause lies in the @apostrophecms/express module's getBearer function. This function is responsible for validating bearer tokens for API requests. The vulnerability stems from an incorrect MongoDB query operator ($ne: [] instead of the correct $size: 0) used to check the status of multi-factor authentication requirements. This logic error allows an 'incomplete' token, issued after password verification but before MFA completion, to be accepted as a fully authenticated token, granting the attacker full API access as the victim.

A secondary, amplifying bug was identified in the finalizeIncompleteLogin function within the @apostrophecms/login module. This function fails to properly delete the incomplete token from the database after a legitimate login because it uses the wrong identifier (token.userId instead of token._id). This leaves the incomplete token active and exploitable for its entire lifetime (defaulting to one hour), even if the legitimate user logs in successfully.

The exploitation process begins when an attacker, having compromised a user's password, makes a login request. The initialLogin function issues an incompleteToken. The attacker then uses this token in the Authorization: Bearer header of subsequent API requests. The getBearer function incorrectly validates this token, leading to a full session hijack. Therefore, getBearer is the primary vulnerable function that would appear in a runtime profile during exploitation.

Vulnerable functions

getBearer

packages/apostrophe/modules/@apostrophecms/express/index.js

The `getBearer` function in the bearer token authentication middleware contains a flawed MongoDB query. It uses `$ne: []` to check for MFA requirements, which incorrectly validates tokens that still have pending MFA steps (e.g., `['AposTotp']`). This allows an attacker to use an 'incompleteToken' as a fully authenticated bearer token, bypassing MFA entirely. This function is the core of the vulnerability as it processes the malicious bearer token.

finalizeIncompleteLogin

packages/apostrophe/modules/@apostrophecms/login/index.js

This function contains a secondary bug that amplifies the main vulnerability. It attempts to delete the incomplete login token after a successful login, but it incorrectly uses `token.userId` instead of `token._id` for the deletion query. This failure to delete the token means the incomplete token persists and can be used by an attacker for its full lifetime (default 1 hour), even after the legitimate user has completed MFA.

initialLogin

packages/apostrophe/modules/@apostrophecms/login/index.js

This function is the starting point of the attack. When an attacker authenticates with a correct password but no MFA code, this function generates and returns the `incompleteToken`. While not vulnerable in itself, it is the function responsible for creating the artifact that is then used to exploit the `getBearer` function's logic flaw.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.