CVE-2026-112954: ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ApostropheCMSto a version that resolves this vulnerability.Fixed in 4.34.0
Event History
Frequently Asked Questions
Which deployments are exposed?
ApostropheCMS deployments prior to version 4.34.0 are affected when they expose a public REST API type using publicApiProjection and have excluded fields that are searchable or sortable.
What does an attacker need to exploit this issue?
An attacker can exploit the issue remotely without authentication or user interaction by using search and sort query builders in the public REST API. Exploitation relies on observing search membership or sort ordering to infer targeted hidden values.
Does this expose the full contents of excluded fields?
No. Returned fields remain filtered by publicApiProjection; the issue enables inference about hidden field values rather than direct unrestricted retrieval of those fields.
What is the remediation?
Upgrade ApostropheCMS to version 4.34.0, which fixes the issue.