EUVD-2026-105103

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames...

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

Summary When a user exports content through @apostrophecms/import-export, the module copies the generated archive into uploadfs at /exports/ and returns a public URL under /uploads/exports/. The filename is fully deterministic: site shortName, document type, a YYYYMMDDHHmmss timestamp, and the...

ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

Summary The slugTaken endpoint returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user including editors can enumerate the slug space of private pages, drafts, and archived content. Details POST...

EUVD-2026-105102

ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user...

GHSA-F66C-MPJ2-3R8H ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

Summary The slugTaken endpoint returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user including editors can enumerate the slug space of private pages, drafts, and archived content. Details POST...

NPM: ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

NPM: ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user vulnerability discovered by ? in WordPress npm apostrophe versions 4.34.0...

ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

Summary The getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces...

EUVD-2026-105170

ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users...

GHSA-VH56-5M88-39RQ ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

Summary The getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces...

NPM: ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

NPM: ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users vulnerability discovered by ? in WordPress npm apostrophe versions 4.34.0...

GHSA-7JG5-FRGC-C67W ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form string style field with a CSS property and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget...

EUVD-2026-105171

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization...

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form string style field with a CSS property and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget...

NPM: ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

NPM: ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization vulnerability discovered by ? in WordPress npm apostrophe versions 4.34.0...

ApostropheCMS: Missing Authentication in `cleanExport` Route

Summary The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

EUVD-2026-105172

ApostropheCMS: Missing Authentication in cleanExport Route...

GHSA-RW26-WWFC-9WVM ApostropheCMS: Missing Authentication in `cleanExport` Route

Summary The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

Summary ApostropheCMS lets a module expose an anonymous read API by setting publicApiProjection, which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string before forcing that projection. Two of...

EUVD-2026-105104

ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API...

GHSA-RQGM-CFRP-4HX8 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

Summary ApostropheCMS lets a module expose an anonymous read API by setting publicApiProjection, which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string before forcing that projection. Two of...