CVE-2026-110904: Medium severity Apostrophe ApostropheCMS vulnerability
Published Oct 15, 2026
·Updated
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.
Affected Software
1 affected component
Apostrophe ApostropheCMS<4.33.0
Event History
Oct 15, 2026
CVE Published
via MITRE·01:15 AM
Data Sourced
via MITRE·01:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed to this issue?
ApostropheCMS deployments running a version earlier than 4.33.0 are affected. The issue applies to REST API page-reading requests.
2
Does exploitation require an account or user interaction?
No. The provided CVSS vector indicates that the issue is remotely exploitable with low attack complexity, requires no privileges, and requires no user interaction.
3
What could an unauthenticated attacker access?
An attacker can bypass authentication for REST API page reading, with the stated impact limited to confidentiality. The example request is /api/v1/@apostrophecms/page?all=1.