ApostropheCMS: GET /api/v1/@apostrophecms/page/:id Bypasses ViewRole Restriction And Exposes ViewPermission-gated Fields

🗓️ 22 Oct 2026 07:20:28Reported by Veracode Vulnerability DatabaseType

ApostropheCMS GET /api/v1/@apostrophecms/page/:id bypasses viewRole and viewPermission.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2026-112957	20 Oct 202616:19	–	circl
CNNVD	Apostrophe Technologies ApostropheCMS Authorization Issues Vulnerability	19 Oct 202616:00	–	cnnvd
CVE	CVE-2026-112957	20 Oct 202616:02	–	cve
Cvelist	CVE-2026-112957 ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users	20 Oct 202616:02	–	cvelist
EUVD	EUVD-2026-105170	21 Oct 202617:15	–	euvd
Github Security Blog	ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users	21 Oct 202617:15	–	github
Mend	CVE-2026-112957	20 Oct 202616:02	–	mend
NVD	CVE-2026-112957	20 Oct 202617:17	–	nvd
osv_cve	CVE-2026-112957 ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users	20 Oct 202616:02	–	osv_cve
osv_ghsa	GHSA-VH56-5M88-39RQ ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users	21 Oct 202617:15	–	osv_ghsa

Vulners

Node

apostrophe apostropheRange0.3.3–4.33.0js

Source	Link
github	www.github.com/apostrophecms/apostrophe/security/advisories/GHSA-vh56-5m88-39rq
github	www.github.com/apostrophecms/apostrophe/releases/tag/[email protected]
github	www.github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
github	www.github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498

23 Oct 2026 22:37Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.3

EPSS0.00307

SSVC