CVE-2021-25979: Apostrophecms

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.

Affected products

• Apostrophecms Apostrophecms: from 2.63.0, before 3.3.1 (fixed in 3.3.1)

Published 2021-11-08. Last modified 2026-06-17.