CVE-2026-113653

The open-source Node.js content management system ApostropheCMS is vulnerable to unauthorized data disclosure in versions prior to 4.33.0 . The root cause is that viewRole is not applied to anonymous visitors when user objects are exposed via a publicly rendered relationship or a public API. This...