CVE-2026-110904Medium· 5.3▾ TwilightPoC availableApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.2%
0.2% → 0.3%
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113670Medium· 5.3ApostropheCMS: Page REST API authorization bypass
CVE-2026-112956Medium· 6.5ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content
CVE-2026-113664Medium· 5.3ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
CVE-2026-113666High· 7.1ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
CVE-2026-113669Medium· 5.3ApostropheCMS: Cross-domain session token in URL confers session takeover
CVE-2026-113671Medium· 4.3ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF