CVE-2026-112957Medium· 4.3▾ SunlitApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.3%
The getOne REST endpoint for pages does not apply viewRole type-level restrictions
or viewPermission field-level redaction. An editor-level user who knows a document
_id can read the full content of admin-only pages and their privileged fields, while
the getAll endpoint correctly enforces both restrictions.
Finding 3 — viewRole bypass:
modules/@apostrophecms/page/index.js exposes getRestQuery(req, omitPermissionCheck = false). The getAll path calls publicApiCheckAsync and threads the full query builder
pipeline including viewRole filtering. The getOne path uses a divergent code path
that skips this pipeline.
A page type declared with viewRole: 'admin' is inaccessible via GET /api/v1/@apostrophecms/page?type=secretPage (returns 403 to an editor) but is fully
returned by GET /api/v1/@apostrophecms/page/:id:en:published to the same editor.
Finding 4 — viewPermission field leak:
Fields decorated with viewPermission: { action: 'edit', type: '@apostrophecms/page' }
are stripped by removeForbiddenFields in the getAll path but are returned verbatim
in getOne. An editor who knows any document _id can read all
viewPermission-restricted fields.
# Log in as editor, get session jar
EDITOR_JAR="..."
# getAll — correctly blocked
curl -b "$EDITOR_JAR" \
"http://TARGET/api/v1/@apostrophecms/page?type=secretPage"
# → 403 Forbidden
# getOne — bypassed, returns full document including viewPermission fields
curl -b "$EDITOR_JAR" \
"http://TARGET/api/v1/@apostrophecms/page/ADMIN_PAGE_ID:en:published"
# → 200 OK, full doc including secretField value
Editors can read the full content of any page — including those restricted to admins via
viewRole — if they know or can guess the _id. Sensitive field values gated by
viewPermission are also fully exposed. This breaks the content access control model
for any site using these decorators.
apostrophe < 4.34.0Upgrade to a patched release:
apostrophe 4.34.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113649Medium· 6.5ApostropheCMS: Import API bypasses publication roles for protected content
CVE-2026-113648Low· 3.1ApostropheCMS: Missing Authentication in `cleanExport` Route
CVE-2026-112958Medium· 5.4ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
CVE-2026-112951Medium· 5.4ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
CVE-2026-112952Medium· 4.3ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
CVE-2026-112954Medium· 5.3ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API