ApostropheCMS (<= 4.30.0)

A server-side prototype pollution vulnerability in ApostropheCMS allows an authenticated editor to bypass authorization for all subsequent API requests by polluting Object.prototype via the $pullAll patch operator.