ApostropheCMS: GET /api/v1/@apostrophecms/page/:id Bypasses ViewRole Restriction And Exposes ViewPermission-gated Fields

Summary The "getOne" REST endpoint for pages does not apply "viewRole" type-level restrictions or "viewPermission" field-level redaction. An editor-level user who knows a document "id" can read the full content of admin-only pages and their privileged fields, while the "getAll" endpoint correctly...

ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

Summary The getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces...

GHSA-VH56-5M88-39RQ ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

Summary The getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces...

EUVD-2026-105170

ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users...

npm: ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

npm: ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users vulnerability discovered by ? in WordPress npm apostrophe versions 4.34.0...

Missing Authorization

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

Incorrect Authorization

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

GHSA-XF6W-Q65W-4F2W ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)

Impact Even though it is correctly applied to guests, contributors, etc., viewRole is not applied to the general public. This means that a secured content type like @apostrophecms/user can in theory be accessed. This is greatly mitigated by the fact that there is no automatic public REST API for...

ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)

Impact Even though it is correctly applied to guests, contributors, etc., viewRole is not applied to the general public. This means that a secured content type like @apostrophecms/user can in theory be accessed. This is greatly mitigated by the fact that there is no automatic public REST API for...

CVE-2026-112957

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only page...

CVE-2026-112957 ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only page...

CVE-2026-112957

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only page...

CVE-2026-112957 ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only page...

CVE-2026-112957 ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only page...

CVE-2026-112957

The ApostropheCMS Node.js content management system contains a vulnerability in the getOne REST endpoint for pages prior to version 4.34.0 . The root cause is a failure to apply viewRole type-level restrictions and viewPermission field-level redaction. Consequently, a user with editor-level privi...

PT-2026-120330

Impact Even though it is correctly applied to guests, contributors, etc., viewRole is not applied to the general public. This means that a secured content type like @apostrophecms/user can in theory be accessed. This is greatly mitigated by the fact that there is no automatic public REST API for...

PT-2026-118489

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description The getOne REST endpoint for pages fails to apply viewRole type-level restrictions and viewPermission field-level redaction. This allows a user with editor-level privileges who possesses a...

Apostrophe Technologies ApostropheCMS Authorization Issues Vulnerability

Apostrophe Technologies’ ApostropheCMS versions prior to 4.33.0 have a vulnerability related to authorization. This vulnerability arises from the lack of applying viewRole to anonymous visitors, and insufficient template restrictions. When developers expose user objects through publicly rendered...