CVE-2026-113665

## Summary The notification module exposes `PATCH` and `DELETE` REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. --- ## Affected Code **File** ```text packages/apostrophe/modules/@apostrophecms/notification/index.js ``` ```javascript // restApiRoutes async patch(req, _id) { const dismissed = self.apos.launder.boolean(req.body.dismissed); if (dismissed) { await self.emit('beforeSave', req, { _id, dismissed }); await self.db.updateOne( { _id }, { $set: { dismissed }, $currentDate: { updatedAt: true } } ); } }, async delete(req, _id) { await self.db.deleteMany({ _id }); } ``` Unlike the `GET` notification route, these handlers do **not** verify: - Authentication (`req.user`) - Ownership (`userId === req.user._id`) - Authorization or permissions Instead, the supplied `_id` is used directly against the raw MongoDB collection. --- ## Root Cause The notification REST endpoints perform database operations directly using `self.db` without enforcing authentication or authorization. While the framework provides permission primitives (`req.user`, ownership checks, and `apos.permission`), these endpoints never invoke them. As a result, any request reaching these handlers is processed solely based on the supplied notification ID. For comparison, the `GET` notification route correctly checks: ```javascript if (!(req.user && req.user._id)) { throw self.apos.error('invalid'); } ``` No equivalent validation exists in the `PATCH` or `DELETE` handlers. --- ## Proof of Concept ### 1. Log in as an administrator ```bash curl -sS -c admin_cookies.txt \ "http://localhost:4321/api/v1/@apostrophecms/login/context" \ -o /dev/null curl -sS \ -b admin_cookies