29 matches found
EUVD-2026-105170
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users...
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
Summary The getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces...
GHSA-VH56-5M88-39RQ ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
Summary The getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces...
CVE-2026-113670
Rejected reason: This CVE is a duplicate of another CVE...
GHSA-2J32-Q6RX-H844 ApostropheCMS: Page REST API authorization bypass
Summary The core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public...
ApostropheCMS: Page REST API authorization bypass
Summary The core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public...
EUVD-2026-105219
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated...
CVE-2026-113670
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated...
CVE-2026-113670
The ApostropheCMS Node.js content management system is vulnerable to an authorization bypass in its core page REST API prior to version 4.33.0 . The issue stems from the use of .permission(false) in the getOne and all=1 tree dump handlers within packages/apostrophe/modules/@apostrophecms/page/ind...
CVE-2026-112957
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only page...
CVE-2026-112957 ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only page...
CVE-2026-112957
The ApostropheCMS Node.js content management system contains a vulnerability in the getOne REST endpoint for pages prior to version 4.34.0 . The root cause is a failure to apply viewRole type-level restrictions and viewPermission field-level redaction. Consequently, a user with editor-level privi...
CVE-2026-112957 ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only page...
CVE-2026-112957
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only page...
CVE-2026-112957 ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only page...
PT-2026-118585
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated...
PT-2026-118489
Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description The getOne REST endpoint for pages fails to apply viewRole type-level restrictions and viewPermission field-level redaction. This allows a user with editor-level privileges who possesses a...
Apostrophe Technologies ApostropheCMS Authorization Issues Vulnerability
Apostrophe Technologies’ ApostropheCMS versions prior to 4.34.0 have a licensing issue vulnerability. This vulnerability arises from the fact that the getOne REST endpoint does not apply type-level restrictions on viewRoles or masking of the viewPermission field level. As a result, editing users...
Incorrect Authorization
Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...