---
id: CVE-2026-112954
title: >-
  ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort
  query builders in the public REST API
summary: >-
  ApostropheCMS is an open-source Node.js content management system. Prior to
  4.34.0, a public REST API type that uses publicApiProjection can expose
  excluded searchable or sortable field information through search membership
  and sort orde…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: apostrophecms
product: apostrophe
affected:
  - apostrophe < 4.34.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-23T01:50:29.890744Z'
exploitAvailable: true
published: '2026-10-20'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T01:50:55.523Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112954'
references:
  - url: >-
      https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rqgm-cfrp-4hx8
    label: >-
      https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rqgm-cfrp-4hx8
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
    label: >-
      https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
    label: >-
      https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
  - url: 'https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0'
    label: 'https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-112954'
  - url: 'https://github.com/advisories/GHSA-rqgm-cfrp-4hx8'
tags:
  - cve.org
  - exploit-available
  - ghsa
  - npm
epss: 0.00444
epssPercentile: 0.3847
aliases:
  - GHSA-rqgm-cfrp-4hx8
ecosystem: npm
patched:
  - apostrophe 4.34.0
ingestedAt: '2026-10-20T16:10:53.293Z'
---

## Overview

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.

## Affected

- `apostrophe < 4.34.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-112954)

Affected packages:

- `apostrophe < 4.34.0`

Patched in:

- `apostrophe 4.34.0`

Source: https://github.com/advisories/GHSA-rqgm-cfrp-4hx8