CVE-2021-25979

    Dashboard / Vulnerabilities / CVE-2021-25979

    CVE-2021-25979

    Published: 8 Nov 2021Last Modified: 7 Aug 2026

    Summary:

    Details: Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.

    References: https://github.com/apostrophecms/apostrophe/commit/c211b211f9f4303a77a307cf41aac9b4ef8d2c7c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0ae930a861a077f52c7995d4425b3fecee3775d2
    Fixed -71221f7463372c0e2c7c7638d9fc6f6b85d38239

    Affected versions

    3.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-25979 | CVE-DB