CVE-2026-112957: ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. This issue is fixed in version 4.34.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ApostropheCMSto a version that resolves this vulnerability.Fixed in 4.34.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An editor-level authenticated user can exploit it. They must know the _id of an admin-only page to retrieve its full content and fields that would normally be restricted by viewPermission.
Which endpoint is affected, and are all page-listing requests vulnerable?
The affected endpoint is GET /api/v1/@apostrophecms/page/:id. The getAll endpoint correctly enforces both viewRole restrictions and viewPermission field-level redaction.
Which versions should be remediated?
ApostropheCMS versions prior to 4.34.0 are affected. Version 4.34.0 contains the fix.
What information could be exposed?
The vulnerable endpoint can expose the full content of admin-only pages, including fields protected by viewPermission. The issue is an information-disclosure vulnerability; no integrity or availability impact is described.