ApostropheCMS: Page REST API authorization bypass

Summary The core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public...

CVE-2026-113670

The open-source Node.js content management system ApostropheCMS (prior to version 4.33.0 ) contains an authorization bypass in the core page REST API. The vulnerability occurs because getOne and the all=1 tree dump read full page documents using .permission(false), effectively ignoring viewRole p...

CVE-2026-113670 ApostropheCMS: Page REST API authorization bypass

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated...