---
id: CVE-2026-112957
aliases:
  - GHSA-vh56-5m88-39rq
title: >-
  ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole
  restriction and exposes viewPermission-gated fields to lower-privileged users
summary: >-
  ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole
  restriction and exposes viewPermission-gated fields to lower-privileged users
severity: medium
cvss: 4.3
cwe:
  - CWE-862
vendor: apostrophe
product: apostrophe
ecosystem: npm
affected:
  - apostrophe < 4.34.0
patched:
  - apostrophe 4.34.0
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T17:15:22Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-vh56-5m88-39rq'
references:
  - url: >-
      https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vh56-5m88-39rq
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-112957'
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
  - url: 'https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0'
  - url: 'https://github.com/advisories/GHSA-vh56-5m88-39rq'
tags:
  - ghsa
  - npm
  - cve.org
epss: 0.00307
epssPercentile: 0.23309
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-21T14:24:33.421058Z'
ingestedAt: '2026-10-20T17:12:53.614Z'
---

## Overview

### Summary
The `getOne` REST endpoint for pages does not apply `viewRole` type-level restrictions
or `viewPermission` field-level redaction. An editor-level user who knows a document
`_id` can read the full content of admin-only pages and their privileged fields, while
the `getAll` endpoint correctly enforces both restrictions.

### Details
**Finding 3 — viewRole bypass:**
`modules/@apostrophecms/page/index.js` exposes `getRestQuery(req, omitPermissionCheck =
false)`. The `getAll` path calls `publicApiCheckAsync` and threads the full query builder
pipeline including `viewRole` filtering. The `getOne` path uses a divergent code path
that skips this pipeline.

A page type declared with `viewRole: 'admin'` is inaccessible via `GET
/api/v1/@apostrophecms/page?type=secretPage` (returns 403 to an editor) but is fully
returned by `GET /api/v1/@apostrophecms/page/:id:en:published` to the same editor.

**Finding 4 — viewPermission field leak:**
Fields decorated with `viewPermission: { action: 'edit', type: '@apostrophecms/page' }`
are stripped by `removeForbiddenFields` in the `getAll` path but are returned verbatim
in `getOne`. An editor who knows any document `_id` can read all
`viewPermission`-restricted fields.

### PoC
```bash
# Log in as editor, get session jar
EDITOR_JAR="..."

# getAll — correctly blocked
curl -b "$EDITOR_JAR" \
  "http://TARGET/api/v1/@apostrophecms/page?type=secretPage"
# → 403 Forbidden

# getOne — bypassed, returns full document including viewPermission fields
curl -b "$EDITOR_JAR" \
  "http://TARGET/api/v1/@apostrophecms/page/ADMIN_PAGE_ID:en:published"
# → 200 OK, full doc including secretField value
```

### Impact
Editors can read the full content of any page — including those restricted to admins via
`viewRole` — if they know or can guess the `_id`. Sensitive field values gated by
`viewPermission` are also fully exposed. This breaks the content access control model
for any site using these decorators.

## Affected packages

- `apostrophe < 4.34.0`

## Remediation

Upgrade to a patched release:

- `apostrophe 4.34.0`