ApostropheCMS: Unauthenticated PublicApiProjection Bypass Via Search And Sort Query Builders In The Public REST API

Summary ApostropheCMS lets a module expose an anonymous read API by setting "publicApiProjection", which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string before forcing that projection. Two of...

GHSA-RQGM-CFRP-4HX8 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

Summary ApostropheCMS lets a module expose an anonymous read API by setting publicApiProjection, which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string before forcing that projection. Two of...

ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

Summary ApostropheCMS lets a module expose an anonymous read API by setting publicApiProjection, which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string before forcing that projection. Two of...

npm: ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

npm: ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API vulnerability discovered by ? in WordPress npm apostrophe versions 4.34.0...

Information Exposure

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

CVE-2026-112954

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the...

CVE-2026-112954 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the...

CVE-2026-112954 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the...

CVE-2026-112954 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the...

CVE-2026-112954

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the...

CVE-2026-112954

The ApostropheCMS Node.js content management system (versions prior to 4.34.0 ) contains a vulnerability in the public REST API. A public REST API type utilizing publicApiProjection can be exploited via search membership and sort ordering oracles to bypass projection restrictions. This allows an ...

CVE-2026-96902

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact ma...

EUVD-2026-104800

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact ma...

PT-2026-118244

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact ma...

Apostrophe Technologies ApostropheCMS information leakage vulnerability

Apostrophe Technologies’ ApostropheCMS versions prior to 4.34.0 have a vulnerability related to information leakage. This vulnerability arises from the use of the publicAPIProjection in the public REST API. By searching for member relationships and sorting orders, it is possible to determine whic...

CVE-2026-18037

The Create WordPress plugin (by Mediavine) versions prior to 2.5.4 is vulnerable to an authorization bypass. The root cause is a missing authorization check on a public REST API route , which allows unauthenticated attackers to read unpublished content . Furthermore, accessing this route triggers...

CVE-2026-10524 CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation

The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...

PT-2026-68634

Name of the Vulnerable Software and Affected Versions CoCart WordPress plugin versions prior to 4.9.0 Description An issue exists where the software fails to validate user-supplied price values against the actual product price when items are added to the cart via public REST API endpoints. This...

PT-2026-68651

Name of the Vulnerable Software and Affected Versions WP Hotel Booking versions prior to 2.3.3 Description Unauthenticated users can manipulate the total price of a booking by submitting non-positive values for the qty parameter to the public REST API endpoint. This occurs because the software...

CVE-2026-6675

The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to Unauthenticated Open Email Relay in all versions up to, and including, 2.2.0. This is due to insufficient authorization checks and missing server-side validation of the recipient email address supplie...